Thanks for your comments. I hadn't considered the possible difference
in scope between the S/MIME Message Specification and the CMS, but I can
see that CMS might have broader applicability, and hence, differing
requirements.
This is also the reason why there are, on close examination, no MUSTs
or SHOULDs in CMS.
Yes. CMS has many application beyond S/MIME. We have already started to
see many other applications, including the PKIX CMC.
However, this is not the reason that I did not follow the MUST and SHOULD
conventions. I tried to keep the document structure similar to PKCS#7
v1.5. This way, someone who has a RKCS#7 v1.5 implementation might have an
easier time figuring out what changes were needed to implement CMS.
Russ