>>> You say that it is not clear what validation policy needs to be used,
>>> but this is completely irrelevant to the discussion of the CRL AIA
>>> extension. This extension aid in certification path construction,
>>> not the validation of the path once it is constructed.
>> Not exactly, it could "help" finding a wrong path !
> Not likely. The signer of the CRL is providing a pointer to their own
> certificate. Path construction to locate a parent of that certificate
> through a complex PKI might include paths that are acceptable and paths
> that are unacceptable, but the certificate that contains the public key
> needed to validate the signature on the CRL is clearly needed.
The problem is to know if a CRL that has been fetched "somewhere" is
adequate for the target certificate. It is not to validate a CRL that has
been fetched "somewhere".