[icnrg] recursive key Lookup in CCNX

[Ken Calvert <[e-mail]>]

Why is recursive key lookup prohibited in CCNx 1.0?

I am really surprised that Section 8.1 of RFC 8569 says "we do not allow for recursive key lookup".

First, this seems to dictate a single policy for all applications using the CCNx network layer. That seems like a Big Deal, so I would expect to see some reason given in the RFC, but there's no justification.

I always thought being able to just "turn the crank" and retrieve the key that signed a content object,then the key that signed that, and so on (as long as the names match a trust schema, as described in the Yu et al ICN '15 paper) until you reach a trust anchor was one of the very best things about CCN/NDN.
What am I missing?

Related question:  What is the essential security difference between an X.509 certificate and a KeyLink?  If there's no difference, why require that trust chains be of length one, and end in X.509 certs (or known keys)?  And if there is a security difference, why define a separate Key object at all?

Thanks,

Ken