Without reiterating all of the previous arguments, let me observe that I
do not believe that all of your listed conclusions were actually
ones reached by the PEM working group. There were certainly a number of
them which I hardly remember being discussed in the mailing list, and
I certainly doubt that it could be said that we reached consensus on all
of these items.
It is quite believable that you may have reached these conclusions at
the end of this thread. Whether everyone else on the working group has
is a different question.
Fair enough. I don't mean to speak for the "PEM working group". I'm not at all
certain who the members are of that group, but I have certainly not conducted
a formal poll or ballot.
One of the reasons for attempting to summarize the rather lengthy thread was
to crystallize a position and attempt to gain such a concensus. If you
disagree with particular points in my summary you are certainly welcome
to challenge them or add to them.
On the other hand, most if not all of the points address PCA and CA
responsibilities and conventions, and not architecture or implementation,
so I would think that you could also safely ignore them if you are
not involved in operating a PCA or CA that is intended to serve the
"commercial" user.
I did include one item in my summary which was new, and has not
yet been extensively addressed, and that was my suggestion that
we consider modifying X.509 to include relevant information such
as the user's e-mailo address, physical address, and perhaps telephone
number without requiring that information to be placed in the DN.
I would welcome your thoughts on these subjects, of course.
Bob