John Bradley wrote on 2009-08-25:
> The problem with a URN in the OASIS space would be that it needs to
> include the host name to match the CN of the signing cert.
Don't forget subjectAltName, which should take precedence.
But anything defined has that requirement, and by extension will require the
extraction of that information from the "URI" for comparison purposes along
with some clear set of matching rules (i.e. what about wildcard certs, what
about tail matching for constraining authority in some cases, etc.).
-- Scott
