Possible to use an accumulator to "license" or restrict the qty of certificates being used?
In short:  The parent CA would sign the public key of an n-time signature scheme, as opposed to the public key of a signature scheme which is valid for an unbounded number of signatures (the current design).

n-time signature schemes are usually just constructed by generating n instances of a one-time signature scheme and then accumulating their public keys together into one public key.

The child CA would present their n-time public key (along with a proof that the public key accumulates only n OTS instantiations) to the parent CA to be signed, just like usual.