<HTML dir=ltr><HEAD></HEAD>
<BODY>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2></FONT> </DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV dir=ltr> Signing requests can be problematic to enable by default <BR>because it's a relatively expensive, promiscuous operation for the <BR>server and very cheap for a client, e.g. a DoS risk. </DIV>
<DIV dir=ltr> </DIV>
<DIV dir=ltr> </DIV></BLOCKQUOTE>
<DIV dir=ltr>Nothing to do with your argument about orcon release policies or discovery, but is the above really valid?</DIV>
<DIV dir=ltr> </DIV>
<DIV dir=ltr>In the web generally, we enable SSL clients to sign and propose signed client auth messages everyday. Servers have various remedies, including using appropriate crypto (OAEP) to address the associated cryptanalysis issues facing the secret key, policy (prohibiting acceptance/processing of client auth), and imposing delegated keying ciphersuites (using ephemeral keying applying HSMs easily capable for $100 of doing a ten thousand 1024bit RSA signature verifications a second, for the 100s the ephemeral 1024bit key is in service!)</DIV></BODY></HTML>