Re: URL-level trust (was: Re: XKMS)

> If the client initially trusts a root rather than a response signing
> key from an XKMS service, won't we need to add some authentication
> model for XKMS response signing keys that's analgous to that of OCSP?

We probably have to do something; XKMS certs "buried in the browser" is
clearly a bad way to move forward.  Yet requiring a PKIX bootstrap to
validate an XKMS server is equally bad.  Barring some flash of insight
over the next few months, I expect the best we can do is leave it to our
old friend "out of band"
	/r$
-- 
Zolera Systems, Your Key to Online Integrity
Securing Web services: XML, SOAP, Dig-sig, Encryption
http://www.zolera.com