Re: [sidr] Simpler trust anchor format

[Rob Austein <[e-mail]>]

At Mon, 7 Jun 2010 00:21:49 -0400 (EDT), Sam Weiler wrote:
> 
> I just submitted an i-d documenting a much simpler trust anchor format 
> than the one in the current WG draft.  Like the format in the WG doc, 
> this one allows for a long-lived trust anchor even though the unlying 
> certificate changes more often, e.g. when new resources are added. 
> This format has the advantage of being noticeably simpler.
> 
> I encourage the WG to adopt this format in place of the one in the 
> current WG doc.

I support this proposal.

My validator software supports this trust anchor format, via the
"indirect-trust-anchor" configuration directive.  The semantics are
identical to the "trust-anchor-uri-with-key" format I implemented at
ARIN's request several years ago.  The only change from the older
directive is syntax: Sam pointed out (correctly) that moving the URI
out of the validator's configuration file and into the file with the
public key would make this mechanism easier to use.