RE: Confirm decision on identity handling.

[Gregory Lebovitz <Gregory@netscreen.com>]

> >To allow for more stringent local security policy, 
> implementations MAY 
> >offer
> >a configuration option to check that the idenity presented 
> in the identity
> >payload matches the equivalent identity type in the 
> presented certificate.
> 
> I guess my main question would be, in what way does this 
> allow for a "more 
> stringent local security policy"?

If alice and amy are both users with valid certs, amy cannot connect to bob
using her own cert, but using alice's identity in the identity payload.

I personally don't think it is a big deal, but Steve Kent has said he thinks
it is, and I can see higher security organizations wanting it.