-----BEGIN PRIVACY-ENHANCED MESSAGE-----
With external references, you're dependent on the lifetime and
integrity of the external store. Unless you actually retrieve
the file, there's not much to be said about the lifetime of the
store, but there is something to be said about the integrity.
How about associating a has with each external reference?
Simply compute the MD5 (or any similar) hash on the file and
include it in the reference. The hash will also serve as a
handle for the file and make it easy to associate the reference
with its contents.
I don't think Steve's message was intended to focus on the "handle for
the file issue" even though about half the message talked about just
this application of the hash. Steve?
I believe there is more value in observing that the hash serves as an
integrity check of the file being retrieved. And oh, by the way, it
doubles as a file handle.
Also, an integration of PEM and MIME should make it possible to "sign"
this hash value to guarantee its integrity.
-----END PRIVACY-ENHANCED MESSAGE-----