RFC2632bis and subjectAltName

The document says:

   The email address SHOULD be in the subjectAltName extension

This is exactly the same thing that RFC 2632 says.

If the certificate does not bind the public key to the email address, how 
is this done?  Should we mandate an alternate mechanism?  Or, should we 
change "SHOULD" to "MUST?"
Russ