Ray,
In a message last month you said " At this point, I am
tempted to remove the DN subordination requirement
when checking certificates at this point..." Please don't.
Unless you are prepared to display complete certification paths
for users, the name subordination requirement is necessary to
prevent the last certificate in a chain from spoofing a user. The
reason that 1422 does not completely preclude non-subordinate
certification by CAs is to allow the same infrastructure to be
used for more than PEM. Thus the name subordination requirement
is enforced by UAs.
Steve