[TLS] Old signature schemes in CertificateRequest

["Martin Thomson" <[e-mail]>]

   RSASSA-PKCS1-v1_5 algorithms:  Indicates a signature algorithm using
      RSASSA-PKCS1-v1_5 [RFC8017] with the corresponding hash algorithm
      as defined in [SHS].  These values refer solely to signatures
      which appear in certificates (see Section 4.4.2.2) and are not
      defined for use in signed TLS handshake messages, although they
      MAY appear in "signature_algorithms" and
      "signature_algorithms_cert" for backward compatibility with
      TLS 1.2.

Similar things are said about those involving SHA-1 and other "legacy" schemes.

My reading is that this permits the inclusion of the related signature schemes in CertificateRequest messages.  These can't really be used in CertificateVerify, so there are some interesting corner cases to consider, like the case where only unusable schemes are listed.

I don't think that this rises to erratum level, but it's a bit of a problem.  Ideally, we'd fix this in a subsequent version by saying some more about CertificateRequest.  But then maybe this backward compatibility stuff will no longer be necessary when that time comes (he says optimistically/naively).

Is this right?  How do you think we should track this problem?