Russ:
One of your comments yesterday was that we can make a choice between simpler client and operational security when I said that some implementations require separate CRL signing keys for operational security reasons.
While I agree with you that this is a trade-off an enterprise needs to make. But, I think the Internet RFC should not make such a choice. I am saying that the RFC should permit both: simple client (same key for certificate and CRL signing) as well as different keys for certificate and CRL signing.
PKIX working group is after all, all about security. We should not say that a secure implementation is not compliant with PKIX.