code: func (pa *AuthorityImpl) processHostnamePolicy(policy blockedNamesPolicy) error {
  	nameMap := make(map[string]bool)
  	for _, v := range policy.HighRiskBlockedNames {
  		nameMap[v] = true
  	}
  	for _, v := range policy.AdminBlockedNames {
  		nameMap[v] = true
  	}
  	exactNameMap := make(map[string]bool)
  	wildcardNameMap := make(map[string]bool)
  	for _, v := range policy.ExactBlockedNames {
  		exactNameMap[v] = true
  		// Remove the leftmost label of the exact blocked names entry to make an exact
  		// wildcard block list entry that will prevent issuing a wildcard that would
  		// include the exact blocklist entry. e.g. if "highvalue.example.com" is on
  		// the exact blocklist we want "example.com" to be in the
  		// wildcardExactBlocklist so that "*.example.com" cannot be issued.
  		//
  		// First, split the domain into two parts: the first label and the rest of the domain.
  		parts := strings.SplitN(v, ".", 2)
  		// if there are less than 2 parts then this entry is malformed! There should
  		// at least be a "something." and a TLD like "com"
  		if len(parts) < 2 {
  			return fmt.Errorf(
  				"Malformed ExactBlockedNames entry, only one label: %q", v)
  		}
  		// Add the second part, the domain minus the first label, to the
  		// wildcardNameMap to block issuance for `*.`+parts[1]
  		wildcardNameMap[parts[1]] = true
  	}
  	pa.blocklistMu.Lock()
  	pa.blocklist = nameMap
  	pa.exactBlocklist = exactNameMap
  	pa.wildcardExactBlocklist = wildcardNameMap
  	pa.blocklistMu.Unlock()
  	return nil
  }
docs: // processHostnamePolicy handles loading a new blockedNamesPolicy into the PA.
  // All of the policy.ExactBlockedNames will be added to the
  // wildcardExactBlocklist by processHostnamePolicy to ensure that wildcards for
  // exact blocked names entries are forbidden.