Carl,
I think most people want names in certificates to be
descriptive as well as unique, i.e., the name should be easily related
to the real world entity with which the orivate key is associated.
Any scheme that fails to provide this sort of association creates a
need for other, out of band measures to provide that mapping. A good
certification system provides a context in which one can evaluate the
trust that should be associated with accuracy of the identity claim
implied by the name in the certificate. That's what we are trying to
do. The question of whether two different names refer to the same
physical entity, for the sort of data flow security purpose you cited,
is intrinsically a problem than cannot be solved by identity-based
access controls anyway. That, I think, is a red herring.
Steve