.gitignore sub-dir exclusions not overriding '*'

The behaviour below is seen with both git 1.8.3.2 and git 2.1.3; I am not subscribed to the vger list, please keep me in the CC list.

Use-case: git repo which only holds PGP-encrypted files with a .asc
extension, no matter which sub-directory they're in, or if in the top
directory.

Simple layout; for demo purposes names starting 'incl' should end up included, those starting 'excl' should end up excluded, but not based on those prefices: they're success result indicators; so:

    cd wherever
    git init
    mkdir foo
    touch incl.asc excl excl.txt foo/incl.asc foo/excl.txt foo/excl
    $EDITOR .gitignore

Expected to work as .gitignore in top-level of repo:

    *
    !**/*.asc
    !.gitignore

With that, `git status` ignores the contents of foo/ thusly:

    $ git check-ignore -v foo/incl.asc
    .gitignore:1:*	foo/incl.asc

Commenting out the '*' line and removing the '!' from the second, the **/*.asc clearly matches. The only way I can make this style work is to set the first line to '**/*.*' which fails to exclude the plain 'excl' files (no extension).

It seems that there's some magic around '*' as the entire final path component of a pattern which causes it to match against the entire directory, and excludes of the directory can not be overriden by matches against '*.ext' within the directory, even when they come later in the same config file at the same precedence.

This does not seem to my reading to match the behaviour described by `git help gitignore` (checked in both versions of git) and so seems to me to be a bug, but if it's a failure of my understanding, please help me to understand where I messed up.

Thanks, -Phil