but it still should be constrained because IF anything bad happens (greetings from murphy’s law) and if such a cert appears it will be quite a problem because offline systems cant verify its revocation status.
1 Like