<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt">Shade,<br><br>> > 3 things are different - and not just the same old war horse<br>> arguments, repeated over and over and over again. There are<br>> different types of certs, and IDPs can issue them too (for<br>> "management/discovery purposes").<br>> <br>> Modern browsers have solved the "common CA pool" problem? IDPs can<br>> sign these different cert types (below them in that special type's own<br>> hierarchy) without necessarily being granted the authority to sign ANY<br>> cert, say of the common SSL type?<br><br>Any site can issue a self-signed certificate (or a certificate that's<br>not signed at all), if the certificate is intended to only be<br>presented to the very same site that issued it.<br><br>Btw the relying party could issue a self-signed certificate
that it<br>would verify itself. That's a good alternative to what I'm proposing.<br>But what I'm proposing is simpler for the relying party, which doesn't<br>have to deal with certificates at all.<br><br>Francisco<br><br></div></body></html>