I've just noticed that there doesn't appear to be anything in CMS which says
what you're supposed to do with the content-type attribute when it's present in
the signedAttributes. 11.1 says "The content-type attribute specifies the
content type of the ContentInfo value being signed in signed-data", but there
doesn't appear to be any clear indication of how to apply this when you verify
the signature. I know it's obvious, but it'd be a good idea to mention it
explicitly, perhaps add to the content-type description or maybe 11.1 something
like "Where this field is present, implementations must verify during the
signature validation process that it matches the type of the ContentInfo being
signed".
Peter.