So now that I have to implement "secure transport" as defined by The Direct Project (not to mention reinventing a bunch of wheels, but that's another story for SO), I find myself staring down the barrel at having to create several dozen internal users' S/MIME certificates since (for obvious reasons, I think), I'd very much like to avoid putting the process into their hands as much as possible. An "organization level" cert is out, because "internal reasons."
So basically my question is whether it's available to buy some sort of "organizational CA" cert from an established, that will let me generate and sign S/MIME certificates, so that I can implement to Direct Project specifications without the recipients' clients worrying about untrusted certifications, or having to keep going back to the CA whenever a user joins/leaves the organization? I've tried checking some of the CAs I know of, but they seem mostly targeted at the "end user with a website" SSL certificate, so I may be missing something. Suggestions welcomed and apprciated
Add'l info: For those fortunate souls unfamiliar with it, The Direct Project standard is basically mandated every user's certificate available via either A DNS CERT RR and an externally-accessible anonymous LDAP query, and an S/MIME-capable MTA that can retrieve said cert from either location.