Interfederation

[John Krienke <>]

On 5/28/13 1:26 PM, Cantor, Scott wrote:
> the point of that IOP language has to do with software design and
> behavior, not the "meaning" of metadata in a policy sense.

Here is my follow up question that relates more to policy. Section 2.5.1 line 
285 of the Metadata IOP reads:
"Compromised keys MUST be removed from an entity's metadata."

This is a policy statement for the MD Producer to follow.

If I were to follow the logic behind the need for removal of compromised keys, 
it would be that I care about compromise because previously I cared somewhere 
about possession of the keys in the first place. Somewhere, somehow, we care 
about Possession of keys because we will also care about the compromise of those 
keys. My point is that we need a documented somewhere to care about the 
possession of keys and other very very fundamental levels of bedrock trust. It 
seems a fitting topic to include Compromise in section 2.5 entitled "Metadata 
Producer Requirements." I think it also makes logical sense to include and rely 
on some statement about Possession as well. These kinds of statements seem to me 
to be bedrock requirements for interfederation. I think I am in effect calling 
for a common, minimal set of policies possibly in the form of a declared 
intefederation Registration Practices Statement in order for interfederation to 
be trustworthy.

john.