> If I take your statements/conclusions below to their extreme, then anytime > PKIX comes up with a new service that uses digital signatures, that service > would have to issue its own self-signed certificates. I don't see the OCSP > folks requesting their own self-signed certificates. Not HAVE TO issue, but COULD issue. Most definitely.