> [..]A decent MUA would understand that there may be more than one cert with the same SKI. AKI/SKI is just a hint.
Note also that AKI/SKI chaining SHOULD NOT be checked during path validation. To be more explicit, it's NOT true that the SKI of a CA certificate must match the AKI of a certificate signed by that CA.
Reading this discussion I ask myself: Is there any good reason to set AKI/SKI at all? Is it worth for anything? Or is it just YAPEB [1]?