dnQualifier is used incorrectly

["Manger, James" <[e-mail]>]

It is inappropriate to hold an employee/member/customer number as a
dnQualifier attribute value.  When multiple directories each have an entry
for the same person (or entity) the DN Qualifier disambiguates the entries.
A DN Qualifier value indicates which directory a DN refers to, not which
person in a directory.  In fact, the definition of DN Qualifier says the
same value should be used for all entries in a given directory.  Mapping
from directories to CAs, it is clear that the DN Qualifier should
disambiguate certificates issued to the same person by different CAs.  The
same DN Qualifier value should be used in all certificates issued by a given
CA.  The DN Qualifier should identify the CA, not the subject.

Example:
A company, Frottleby Limited, is certified by two CAs.
The TrustMe CA certifies Frottleby Limited using a DN:
	{ c "AU" / o "Frottleby Limited" dnQualifier "TrustMe Customer" }
The SuperID CA certifies Frottleby Limited using a DN:
	{ c "AU" / o "Frottleby Limited" dnQualifier "SuperID" }


Stephen & Stefan's quotes below are completely at odds with the original, &
surely definitive, X.520 definition of the DN Qualifier attribute.

Stephen Kent says, in 'Re: QC UID support must depart from RFC2459',

	"..I believe that the DN Qualifier makes more sense as a component
of a terminal RDN, at least from the standpoint of directory schema. I would
also suggest that this is the most appropriate attribute as a means of
expressing employee ID, payroll number, etc.  After all, these numbers were
assigned in the pre-X.500 world to achieve the analogous effect, i.e., to
disambiguate among database entries that might otherwise be identical."

Stefan Santesson says,

	"- Attributes for expressing a private identity (... dnQualifier)
...  Here the use of dnQualifier will be constrained to hold a unique
identifier of the subject within the set of all certificates issued by a
CA."

From X.520 | ISO/IEC 9594-6: 1993:

5.2.8 DN Qualifier
The DN Qualifier attribute type specifies disambiguating information to add
to the relative distinguished name of an entry.  It is intended to be used
for entries held in multiple DSAs which would otherwise have the same name,
and that its value be the same in a given DSA for all entries to which this
information has been added.

[DSA = Directory System Agent, basically a directory server]