I've actually reworded it to use mostly a very generic "email address associated with the cert" (someone pointed out that there doesn't actually have to be an email address in the cert for it to be associated with one). The intent was never to provide an exhaustive enumeration of all possible places it could be hidden, just to say that it was whatever address(es) were associated with the cert.
Which is perfectly right since the draft specifies a simple query interface and (hopefully) nothing else.