It looks like the confusion concerns whether or not the key
selector is a new field within the X.509 certificate (vs. an
arbitrary identifier in addition to the X.509 certificate), and
whether or not the selector is optional in the presence of an
X.509 ccertificate containing the public key.
I would agree with this assessment.
My reading is that the selector is an additional field outside
the certificate, and that it is optional if either the X.509
certificate or bare public key itself are present. If my
understanding is correct, I also fail to see any problem.
This is correct.
Jeff?
Jim