> What exactly causes it to move along the chain? Would it only do that if it > thinks there's no explicit key configured (i.e. a metadata problem as Rod > suggests)? It falls through if an explicit key verification fails, for whatever reasons. The wiki documents in exhaustive detail exactly what it does in each trust engine. -- Scott