All,
I apologize for being fickle, but I agree with Blake's most excellent
argument that the "Signing Certificate Attribute" should only contain the
IssuerAndSerialNumber of the signer's cert and should not be a SEQUENCE OF
IssuerAndSerialNumber. Once the app has obtained the signer's cert, it will
very probably include an authorityKeyIdentifier extension that includes the
IssuerAndSerialNumber of the issuer's cert, so the app can identify the
issuer's cert in that manner. In summary, I agree with Jim's original proposal.
================================
John Pawling
jsp(_at_)jgvandyke(_dot_)com
J.G. Van Dyke & Associates, Inc.
================================