Similarly for http
to html hypermedia security interactions. This will be lots of fun; but
going to take a while, I forsee.
This is why I don't think its a good idea to start from the proposal that
Secure[HTTP] = PEM. Unless people want to make PEM hideously complex I
doubt that its feasible. Even if it were there are shortcuts avaliable in
HTTP that arn't in email. In HTTP one can always offload stuff onto a URI.
If it turns out that it is possible to achieve everything people want in
Web security by using PEM then fair enough. If not then there will be
divergence
at some level. As it is S-HTTP incorporates PEM as one security domain.
The main issue is of certificate and code reuse. Anyone writing a MIME/PEM
client might as well got the whole hog and write a Web browser. Separating
Mail and News was always a bad move IMHO. I think the future lies somewhere
inbetween.