Comments on draft-sun-handle-system-11

[Russ Housley <housley@vigilsec.com>]

draft-sun-handle-system-11.txt

  Most of my previous concerns have been resolved.  One remains.

  In section 7.3, it says: "The trust between the client and its proxy and 
caching server has to be setup independently."  If the server returns a 
signed response, I assume that the client can determine that it came from 
the correct source, regardless of the number of proxies that are in the 
middle of the communications path.