Hello Daniel,
I'm not sure if I can answer your question directly, but i'll put what I can to try and lead this to the right question being asked.
As far as why an EPG can only be bound to a single BD, has to do with the underlying object model. The EPG is the construct that represents a container of your endpoints (in your case, web-servers). The BD is the layer 2 construct that can perform a variety of other functions. At its heard, it is not a pure straightforward 1 vlan = 1 subnet correlation. BDs allow for multiple subnets to exist, and vlans are mostly for traffic recognition and EPG processing.
You mention that for your design, you are sticking with one BD per subnet. I believe this type of design is utilized during migration scenarios we the fabric is transitioned to a full mesh ACI abstracted topology.
So what this means, is that in your case, you will need to have a separate BD per subnet (and subsequent EPG) in order to get this to work. That is, as long as you remain with the 1 subnet per BD design limitation. If you were to place both subnets into the same BD, you would be able to accomplish having both web-server subnets encompassed within a single EPG/BD.
Please see the following diagram:
http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-731960.html#_Toc405844640
Here is a bit more on Bridge Domains and their purpose:
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/aci-fundamentals/b_ACI-Fundamentals/b_ACI-Fundamentals_chapter_010001.html#concept_8FDD3C7A35284B2E809136922D3EA02B
Please let me know what followup questions you have.
-Gabriel
