I did include one item in my summary which was new, and has not
yet been extensively addressed, and that was my suggestion that
we consider modifying X.509 to include relevant information
such
as the user's e-mailo address, physical address, and perhaps telephone
number without requiring that information to be placed in the DN.
Have you looked at PKCS #6 (available via anonymous ftp from rsa.com)?
It gives a syntax for extended certificates that includes a set of
attributes as well as the distinguished name and public key.
X9F1 is looking at similar structures for the X9.30 and X9.31 DSA/RSA
standards.
And the recent "chance to fix X.509" seems to offer some opportunity
in this direction.
-- Burt