Re: Finding PKIX Servers!

[Michael Sierchio <kudzu@xxxxxxxx>]

"Perry E. Metzger" wrote:

> Cert directories are totally unneeded in the model I'm describing
> because the issuing bank can just store the cert (or even a naked
> public key) with the account information.

Agreed on that count.  I suppose that what I was trying to say is
that the signer of a cert (or issuer of a keypair,  maybe a bank?)
has an authoritative role.  A directory is just a collection, a
means of publication,  and has no authoritative role.

A business enterprise may find an internal (LDAP) directory of certs
useful for DH key agreement for IPsec, for example.  But there is
no need for a GLOBAL directory structure, AFAICT. 

Other than arguing against the need for such a global directory
infrastructure,  do you have philosophical or aesthetic problems
with it?