> This makes path discovery even harder than it was before. If we > require that self-signed certificates be forbidden or ignored in > PKIX path validation, none of this will be a concern. > Why does PKIX need to say something that is essentially already in X.509? Aren't self-signed certificates of type a) ignored for path validation in X.509?