I for one, must admit that I have always been a bit baffled at just how
CRL's were supposed to work in the real world. If pem is just an
improved version of internet mail. Them the CRL's appear to be sever
over kill. If pem is to be real work done by real people in which
security is an integral part of their work, a CRL request must be issued
after every mail receipt.
Right now business just checks to see if the PO can from the company
that they have a business relationship with. If the order is
expceptional (large, to a new address, etc.) they might check it
against the current D&B rating. The CRL is a new requirment for email
that snailmail does not require.
Could the problem be that no one ever stated the purpose of PEM? -- or
the audience?
Peace
Tom Jones - ViaCrypt div. of Lemcom Sys