It seems several organisations had the same idea of including a list of extensions in a certificate request. There are at least two OIDs that are used and there may be more: so the list is configurable.