This is Google's doing, just like the Client Authentication EKU debacle.