There has been some discussion regarding the proposal to have CRLs signed with CA keys which do not also sign certificates. Since this will not be a mandatory to implement feature, I am concerned about the impact on pkix compliant clients who encounter CRL signed in this way, and how we expect them to behave. What seem unacceptable with the current proposal is that the signage check on the CRL will fail, and the client will have little clue as to why and if this failure is expected. The information in the chain, while present, is in the CAs certificate, is difficult to find and subtle so would be easily missed by someone debugging this problem. I would like to see some clearer indication in a critical extension in the CRL itself that would indicate what was going on. In expressing these semantics in a critical extension, we maintain the principal that if you don't understand the extension, the client knows to fail due to its own inadequacies and that failure is by design, therefore allowing the client's to return an error unsupported option rather than invalid signature. Trevor