[netconf] draft-ietf-netconf-trust-anchors and unconstrained public keys

[Carl Wallace <[e-mail]>]

Section 4.2 states:

	This module also enables the configuration of certificates, where each certificate may constrain the usage of the public key according to local policy.

Assuming local policy means relying party defined policy, this won't work unless the signature on the certificate is ignored. Defining or using a structure in this draft that supports local application of constraints may help avoid reliance on public keys that are unnecessarily broad. RFC 5914 defines a structure that allows for associating constraints with raw public keys or certificates. The default representation of the TA structure in 5914 is simply a certificate, so it'd fit here pretty easily. Historically, trust anchors have been essentially unconstrained but that may not always be the case going forward.