The algorithm constraints are support in PKIX key manager, however SunX509 key manager does not support it yet. As SunX09 is the default key manager, for default safe, we may want to make more evaluation whether it is possible to support algorithm constraints in SunX509 key manager, too.

If a key manager does not supported algorithm constraints, there may be interop issue because one side cannot select the right cert while the other cert will reject weak cert because of algorithm constraints.