Signature validation filter config

[Tom Scavo]

On Mon, Apr 14, 2014 at 1:14 PM, Brent Putman <putmanb at georgetown.edu> wrote:
>
> I can think of at least 2 use cases where the user would want or need to
> wire in multiple validation certs/keys: 1)  for the dynamic metadata
> resolvers(s), where you really do have multiple concurrent trust
> material 2) key rollover, i.e. the metadata publisher announces that
> they are switching to a new key on a particular data, and the deployers
> want to wire in both keys so the change is transparent. If we think that
> those 2 cases are uncommon enough to warrant doing away with Chad's
> original plan, then I suppose those people would just go to the full
> trust engine option.

I don't understand the first use case but the second use case is
definitely the exception (rather than rule). As long it's possible to
do ("full trust engine option"), then I would think that's okay.

Tom