Submitter's message This contribution proposes updates to clause 5.4.10 and 5.7.1 of IPNNI-2026-00021R001 to describe the PA-CA direct-CRL model, where each issuing root/intermediate certificate held by the PA-CA signs a direct CRL for the certificates it issues.
This replaces the previous model where a PA-CA end-entity certificate signs the direct CRL. The problem with that previous model is that there is no way to revoke the CRL end-entity signing certificate or it's parent intermediate certificate.
-- David Hancock