On Jan 29, 2009, at 4:43 PM, John Bradley wrote:
> I consider everything in the XRD to be self asserted claims with the
> exception of the CID if the XRD is signed.
Do you believe this to be the case regardless of the number of
indirections between the original resource URI and the terminal XRD
instance canonicalID?
If there are multiple redirections between the initial resource
identifier before reaching the XRD, and assuming the HTTP Authority
trust profile, where the signing key is in the DNS administrative
realm of the XRD location, I do not see how the signer has any
knowledge of prior indirections (and thus the validity of the
association between the initial resource and the CID).
Or perhaps I am straying into an obscure use case?
=peterd
