RE: Evaluation: draft-ietf-sigtran-security - Security Considerations for SIGTRAN Protocols to Proposed Standard

["Wijnen, Bert (Bert)" <bwijnen@lucent.com>]

>                     Yes    No-Objection  Discuss *  Abstain  
> Bert Wijnen         [   ]     [   ]       [ X ]      [   ]

On page 9 I read (2nd para):
   Note that IPSec is considerably less flexible than TLS when it comes
   to configuring root CAs. Since use of Port identifiers is prohibited
   within IKE Phase 1, within IPSec it is not possible to uniquely
   configure trusted root CAs for each application individually; the
>> same policy must be used for all applications. This implies, for
>> example, that a root CA trusted for use with a SIGTRAN protocol must
>> also be trusted to protect SNMP. These restrictions can be awkward at
   best. 

I have marked a few lines with >>
Can someone explain to me how it "implies" or "follows that the
SIGTRAN protocol must also be trusted to protect SNMP. I guess I cannot
find the proper context as to how SNMP plays a role here.

Bert