Can we have our Internal CA root signed as a child of our wildcard certificate...
Wildcard certificate can only show up in end entity certificates if everything is working as intended or expected. And they will only show up in the "lower level" end-entity certificates, such as domain validated; and not the "higher level" extended validation certificates.
If everything is working as intended or expected, an end-entity certificate will lack
cRLSign), so it won't be able to act as a CA root and anchor a chain of trust. You won't be able to countersign anything with an end entity certificate.
This distinction between different levels or classes of certificates is touched upon below, but you are encouraged to read two chapter's from Peter Guttman's Engineering Security. Specifically, see Chapter 1 and 8 (IIRC).
CAs can sign other CAs (there's some hand waiving here, no stones, please). That's called countersigning, and its used to bridge different PKIs. For example, US Federal uses bridges to allow Treasury to consume certificates from the State department (etc).
Bridging is slightly different use case than what's used under the typical Browser model. In the browser model, cross-signed certificates are not used; rather 100's of root and intermediate certificates are pre-installed and trusted for the same effect (and more!).
Finally, the rule that "EV Certificates cannot have Wildcards" comes from the CA-Browser (CA/B) Forums. The CA/B have two guides that participating CAs and Browsers follow, and the rule is from the extended guidelines.
Taking from the extended guide, page 15:
9.2.2 Subject Alternative Name Extension
Certificate field: subjectAltName:dNSName
Contents: This extenstion MUST contain one or more host Domain Name(s)
owned or controlled by the Subject and to be associated with the Subject’s
server. Such server MAY be owned and operated by the Subject or another
entity (e.g., a hosting service). Wildcard certificates are not allowed
for EV Certificates.
so that installing that cert into guest devices/browsers/whatever doesn't present anything about an untrusted root
No. The user would have to install it as a trust anchor. For example, as a "Trusted Certifcate" in a certificate store. Simply providing it as an end-entity certificate should have no effect.
Also, on a bit of a side point, why does the addition of a wildcard double the cost of certificate purchase?
To preserve profit levels.
Extended Validation certificates are another trick used to restore profit levels to a place in time before the race to the bottom destroyed confidence and profits. Taking from Peter Guttman's Engineering Security, pp. 63-64 (Guttman calls it "PKI me harder"):
The introduction ... of so-called high-assurance or extended
validation (EV) certificates that allow CAs to charge more for them
than standard ones, is simply a case of rounding up twice the usual
number of suspects - presumably somebody’s going to be impressed by
it, but the effect on phishing is minimal since it’s not fixing any
problem that the phishers are exploiting. Indeed, cynics would say
that this was exactly the problem that certificates and CAs were
supposed to solve in the first place, and that “high-assurance”
certificates are just a way of charging a second time for an existing
service. A few years ago certificates still cost several hundred
dollars, but now that the shifting baseline of certificate prices and
quality has moved to the point where you can get them for $9.95 (or
even for nothing at all) the big commercial CAs have had to reinvent
themselves by defining a new standard and convincing the market to go
back to the prices paid in the good old days.
This deja-vu-all-over-again approach can be seen by examining
Verisign’s certificate practice statement (CPS), the document that
governs its certificate issuance. The security requirements in the
EV-certificate 2008 CPS are (except for minor differences in the
legalese used to express them) practically identical to the
requirements for Class 3 certificates listed in Verisign’s version 1.0
CPS from 1996. EV certificates simply roll back the clock to the
approach that had already failed the first time it was tried in 1996,
resetting the shifting baseline and charging 1996 prices as a
side-effect. There have even been proposals for a kind of
sliding window approach to certificate value in which, as the
inevitable race to the bottom cheapens the effective value of
established classes of certificates, they’re regarded as less and less
effective by the software that uses them...