Re: X509 data element

>         My question is, if there is a content in the XML document we
> cannot trust, then shouldnt we, not use it for any purpose. What
> situation a data which can't be trusted be useful.

Signature validation might be performed by a third-party service that 
has no knowledge of the signer identities; separating authentication 
from authorization.  Perhaps it might help if you think of validation as 
a tri-state: trusted, untrusted, and indeterminate.


<example removed>

Your example can be summarized like this:  the organization is using 
unsigned data in its operations, and that can be hacked.  I agree.  But 
that's irrelevant here.

	/r$