Sorry that I didn't join into this thread earlier.
I agree with Michael that implementation-wise the child entry approach is
very lightweight (only configuration in most of the clients, and no
implementation issues in the server).
To sum up the discussion, the opinion in this group seems to be biased,
and I can make out 4 different statements:
1. we should keep the current way of storing certificates and handel the
problem of multiple certs via componentMatching if this is a problem
at all.
2. we should change to the child entry approach because that will solve
the problem of multiple certs (yes it is a problem) and will be far
easier to implement.
3. we should propose both solutions in a way that they don't interfere
with each other and let the implementers decide whether to implement
one or both of the proposed solutions.
4. I don't care which one we choose, but we should definitey not have
two different solutions.
We heard arguments for all 4 directions on this mailing list. I for one,
as you can guess would prefer 2 or 3. I do understand 4 though, especially
if I think about the cert validation proposals. Nevertheless two different
solutions to one problem might be preferable here.