In the case that certification is being used for authorization purposes,
i.e. when you derive capabilities, access rights or whatever from authen-
ticated DNs, that certification structure is too restrictive, in my view.
It has been a while since I have followed this closely but I believe
that PEM certification implies no authorization. PEM certificates
are used by PEM solely for the purpose of authenticating identity.
What use other applications wish to make of certificates is, of course,
up to them.
John