At 11:41 AM -0400 8/24/07, Carl Wallace wrote:
> I agree. A Trust Store Anchor may correspond to a TAA, butthe trust anchors that are installed clearly do not (e.g., Verisign's trust anchors will be installed by a lot of entities that aren't part of Verisign).I don't think we should preclude the use of application TAs as TSAs. An application TA could function a trust store anchor in cases where an enterprise TA is be used to sign TA management requests and serves as the root of a PKI, for example.
I don't think David was precluding application TAs as TSAs. He was saying that they all not all TA owners should be TAAs.
--Paul Hoffman, Director --VPN Consortium