Policy-Discussion

[Philipp Gühring <pg AT futureware.at>]

Hi,

> I'm not sure I understand the question but I'll try to answer.

I would say your answers properly explained the topic and the options.

[...]

> Case 2) must be split into two cases: 2a) where the public/private
> keypair is generated by the CA, and 2b) where the public/private keypair
> is generated by "client" (in for instance browser, webserver, or
> smartcard)

CAcert never generates the keys for the users, so only 2b would apply for 
CAcert.
(Which is very good on the one hand, but gives us very hard problems on the 
other hand as well)

Best regards,
Philipp Gühring