vfychain should be able to choose the usage when verifying a chain . Turns out
it can, but it's undocumented. It takes -u <x> where x is an integer which maps
to SECCertusage . It would be very helpful if that option was documented, as
well as what the usage values mean.
This got fixed long ago