using a cert bundle in a TrustEngine

[Peter Schober]

* Liam Hoekenga <liamr at umich.edu> [2014-01-31 16:06]:
> Their metadata includes separate KeyDescriptors for signing (using a
> certificate signed by a verisign CA through two layers of intermediaries)
> and encryption (signed by a CA internal to their novell infrastructure).
> 
> Don't we need to set up TrustEngines for validation if they're going to
> sign or encrypt their assertions?

You're talking establishment of technical trust for bilaterally
exchanged metatdata (and material within that), right?
If so there's no short or one right answer. You do what you feel
necessary to ensure the metadata (or keys) is authentic.
You could verify the certificate's fingerprint with the tech-c on the
phone or whatever. Or do the trust path validation once, manually,
e.g. with openssl. That will assure you that the key at hand was
issued to the right organization (if you believe in commercial CAs'
practives), if little else.
Once you've establshed the authenticity of that key you'd just use it
like a self-signed one, i.e., put in in (unsigned, locally-managed)
metadata and be done with it.

If you're not referring to bilaterally exchange you'll need to be more
explicit about the scenario.
-peter