Dear all,
Coming back to what was mentioned at the last meeting, I would like to
mention that in my view, the signed verification response profile could
for instance be used in environments where clients would like to get
some signed prove that the signature was verified by a trusted server in
case by some reason this should be exhibited before other entities.
To me, initially this seems ortogonal to the fact that the server
actually found more than one signatures in the document and incorporated
in its answer one report for each verified signature.
The individual reports may come in signed or unsigned VerifyResponse:
the determinant issue is whether the document is signed by one or by
more than one signatures... The signature on the VerifyResponse would be
added by the server whenever the client asked for that if the server has
capability.
In summary, initially, to me these two things are ortogonal and not sure
that they should be mixed in one profile...
Regards
Juan Carlos.