Unless you are prepared to display complete certification paths
for users, the name subordination requirement is necessary to
prevent the last certificate in a chain from spoofing a user. The
reason that 1422 does not completely preclude non-subordinate
certification by CAs is to allow the same infrastructure to be
used for more than PEM. Thus the name subordination requirement
is enforced by UAs.
Actually, I do always display complete chains. However, the issue of
how to get residential CAs to work in a DN subordination environment
still remains.
I've taken a compromise stand of not requiring subordination between
top layer CAs (directly beneath PCAs) and the next layer and will
adopt this scheme unless the residential CA issue can be resolved.
-Ray