Bob,
I also agree with Steve Kent that authorizations have no place in DNs or
Certificates. I would go further and state that I am very suspicious of the
entire concept of authorization certificates. I think that if you look at
how disclaimers most often appear in the "real world" you will see that
typically they are attributes of the instrument, not of signer. e.g. the
"Not valid for more than $1000" statement is an attribute of the bank draft,
not the person who signed it. In the case of a payroll check, the signature is
almost unnecessary. Usually it is applied as a rubber stamp.
I could imagine a MIME/PEM compliant content which has as attributes
such
disclaimers.
John