2. The issuer (CA) field of a PKC needn't correspond to a entry in the
DIT. However, this may be useful as that entry might contain an
objectClass attribute value of certificationAuthority, which indicates
that the CA's entry contains information such as a PKC revocation
list.
isn't strong enough. The "useful"ness of a one to one mapping
of DNs not only allows one to extract the CRL but to extract
the issuer's certificate and so recursively along the chain.
This is true for _every_ application which uses certificates
that I am aware of.
Let's not forget that "polyinstantiation" (I love that term) of a CA
in different hierarchies may lead to a "many to one" mapping of DIT
names and certificates.
Otherwise, I think we're in full agreement. Let's take this as an
invitation to actively define such a relationship from the PEM
perspective.
-Steve