size of client cert, and unknown extensions, unrecognized URI schemes

Should the spec say that the client cert has no limit on size (except what
SSL imposes)?

 

Should it say that critical extensions must be processed in conforming
manner (or is the VA not required to be conforming)? Typically, if the VA
does not recognize and handle critical extension X, its required to view the
cert as invalid. But! That's an X.509 semantic, that really doesn't apply
here (particularly when the cert is self-signed, and not truly "a cert" in
any case, being technically a "trust anchor").

 

Presumably, the VA need only process those URI schemes it recognizes in the
SAN URI field, just ignoring the rest as if not present.

 

Im  going to be putting some large data URIs in my SANs, to see what
happens. They will contain javascript, and json. The javascript will
probably include an implementation of DES, suitably modified so it's not
standard DEA.