Bob,
While I sympathize with your desire to use PEM for a wide
range of good stuff, I wholeheartedly disagree with your conclusion
that a disclaimer must be embedded into a certificate to make this
work. I don't believe that you have provided sufficient evidence that
alternative ways of providing the requisite facilities are untenable.
It is pretty clear that a disclaimer attribute is completely out of
whack with tye semantics of a DN, when viewed in the context of X.500.
I appreciate the desire to build applications using PEM as a
foundation and to minimize the extra mechanisms, infrastructure, etc.
that may be required, but I must agree with Charlie that you seem to
be trying to distort Dns in order to force fit what we have defined so
far into a means of pursuing yoyur particular application goal.
Steve
P.S. I'd write more, but the access line speed from my hotel room leaves
something to be desired.