vfychain should be able to choose the usage when verifying a chain . Turns out it can, but it's undocumented. It takes -u <x> where x is an integer which maps to SECCertusage . It would be very helpful if that option was documented, as well as what the usage values mean.
This got fixed long ago