RE: SCVP-01

["Salz, Rich" <SalzR@xxxxxxxxxx>]

Since this WG is based on the premise of using X509 certs, those VPN
vendors that will never use certs (as opposed to waiting until things get
"eaiser") are out of scope here.

But the OCSP protocol doesn't need certs.  It needs a DN and two key hashes.
Why not just define an OCSP critical extension that says "verify this cert,
and verify up the chain as well."  The footprint for a dedicated DER parser
that knew how to generate only those requests, and parse only well-formed
replies, would be pretty small.

Why won't that work?