Re: Verifying certificate chains with different policies

[Stephen Kent <kent@xxxxxxx>]

Dean,

I think that one should keep the notion of accrediation of CAs (relative to
some criteria) very separate from PKI topology for validation of
certificate paths.  CAs can express the policies that they follow via
appropriate extensions, and the accrediation authorities can then attest to
the fact that the CAs in question do follow these policies.  The
attestation can take many forms, including attribute certificates, online
queries, etc.

Steve