[keyassure] dane-04 trust anchors

[Yaron Sheffer <[e-mail]>]

Hi,

the new text is a major improvement over the previous version. But it is 
still missing some necessary guidance.

My reference scenario is this: I am a phisher. I'd like to trick 
BigBank's customers, so I acquire bigbang.com (an easy misspelling). Now 
I can get a certificate that they will use as a trust anchor, and 
include whatever I want in it, such as the Subject field, "Your trusted 
BigBank".

Moreover, even if I am the rightful owner, the current text does not 
allow me to restrict the certificate's use.

So I propose the following text added:

Client treatment of any non-key information included in the trust anchor 
is a matter of local policy. It is noted that this specification does 
not mandate that such information be inspected or validated by the 
domain registrar.

The client MUST obey any constraints included in the trust anchor, 
including but not limited to:
- Validity period.
- Key usage fields.
- Path length constraints.
- Name constraints.
The normal rules of RFC 5280 apply.

Thanks,
	Yaron