>Isn't the point that AKI:s and SKI:s should use a generation algorithm that
>assigns them a globally unique value with high probability and therefore
>SHOULD be derived from the public key and NOT use a "monotonically increasing
>sequence of integers". At least not starting from a small integer?
There is some reason why CAs do this, I can't remember why but I think it was the usual ostrich algorithm ("There is no CA but us; to think otherwise is treason punishable by limb reconstruction"). I'm not quite sure why the RFC tells you to do this though, since the only safe response to it is to ignore any sKIDs of that form.