1. I'd like more information on whether you and others want this simply
as a "good thing", or whether we have real evidence that this will
address a real problem, based on past evidence and future plausibility.
If this is mainly just a "good thing" then while I might agree that it's
a "good thing" as well, I don't necessarily want to enshrine it in
policy, at least right now.

2. I need proposed language for a future policy draft, and a consensus
behind that language; this by implication also means consensus on what
the minimum requirements should be for each type. If there is no such
consensus then I will postpone this issue to a future version of the policy.

3. I would like to see some investigative work done to determine how
this policy would affect "incumbent" CAs (i.e., CAs already in the list
prior to my taking on approving new ones) and "newly-approved" CAs
(i.e., CAs I've approved myself). Since part of the policy involves the
possibility of going back and re-considering CAs already on the list,
I'd like to know how this proposed change is going to affect things.
(For example, will we have to face a decision on kicking out a lot of
CAs, or at least restricting the "trust bits" we set for them?)

4. I would like clarity on how existing Mozilla/Firefox/Thunderbird/etc.
implementations may interact with such a policy. (For example, I think
you previously alluded to Mozilla implicity trusting JavaScript in some
context if it were downloaded from an SSL-enabled site.) I am reluctant
to implement a policy if the code itself negates its intent.

Frank

--
Frank Hecker
hec...@hecker.org