Online PCA's

Christian> Looks like the only way to solve the "very stringent
requirement" that you mention is to either wait a couple of [months,
weeks, days, hours] or to have an "online" exchange with the CA...  Do
we envisage to deploy that?  I was under the impression that real safe
CAs were off line for security reasons!

The "online" exchange for the CRL's is with the PCA, which clearly must
be "online" for PEM to work, since that is the user's only guaranteed
access.

Peace ..Tom Jones