[SCITT] Distributing a transparency statement in TEA

["Olle E. Johansson" <[e-mail]>]

Hi!

Thank you for a good meeting yesterday!

I’ve tried to read up on the drafts and the presentations available.

A few issues came up in my head :-) :

* Relation between a transparency statement and the issuer/signer

If a SCITT ts is distributed separately and the relaying party wants to verify with the log - is there any way to discover a path to the transparency log API from the actual statement?

* Transparency artefact (“statement”) types
In the use cases you have a non-normative list of various artefacts that may be used in statements.
We have the same issue in TEA - we don’t want to maintain a specific list. If I understand it right you simply use media-type in the SCITT statement - am I right in that or will that list be used in any other way?

For statements that are more generic, let’s say a PDF file with a statement of conformity with an EU law - application/PDF will not be very useful. I think we need some extra attribute or a registry to handle this. What do you think?

* Digital signatures on objects

I strongly think we have to have a PKI discussion. Your trust anchor store doesn’t scale much. I do think that DANE and DANCE may have a role to play here to provide more scalabilty.

To summarize: I think that there are plenty of ways TEA will co-work with SCITT and there are areas we can work together to use the same terminology and make sure that there is compatibility.

Cheers from a sunny Sweden!

/O