Let me ask the following question: Why have an
Originator-ID-Asymmetric field at all when an Originator-Certificate
works just fine? Why was it put in the standard? It is an
implementor's nightmare.
I think the assumption was that it was desirable to cut down on
all of the clutter that results from including all of this information
in the message every time.
Whether or not we ever have an X.500 DUA which will support
this, it is still desirable to retrieve a certificate from your local
cache based on the Originator-ID-Asymmetric, rather than
having to spend the bandwidth of including the certificate
in every message.
Bob