I don't mean to criticise the Mitre work, for I know nothing about it. But
X.500 is clear intended to be a means of distributing certificates and CRLs,
not as a corporate database
In my view, any signed messages that are received should be archived along with
the complete chain of certificates and a current CRL. A centralized corporate
facility for doing that is a nice idea, but rather independent of the
distribution problem, unless we were to decide that it would be best if the CA
were to archive all past certificates and CRLs and make them available by an
on-line request (whether X.500 based or other).
Bob