John,
PEM does not mandate DER for transmission, but encourages it.
The theory was that most folks would send DER, since they went to the
trouble of doing the encoding for signature purposes anyway, and that
a quick check (e.g., against a cache entry) assuming DER would be
reasonable on input, with a fallback of encoding to DER if the check
fails. However, if I recall the example certificate, it was faulty in
that it had multiple occurances of the same attribute type in a single
RDN, which I thought would be unusual and which Marshall cited as
invalid.
Steve