At minimum, requests should be permissible through e-mail, FTP, HTTP and by a trusted third party. Only one method per protocol should be adopted. Some implementations require the entire certificate chain to be verified, using many expensive signature verification operations. Others don't walk the entire chain and compro mise security. Once again, OCSP solves t he problem by offloading processing to the security server.
Users incorrectly assume that commercial services are the only way to go.
Default configurations such as approved directory servers and certificate signers, certificate usage and approved software publishers should be locked down in some environments. This keeps ownership of corporate assets within the corporation and protects against data loss. When there's centralized escrow of encrypti on keys, a second signing key should be issued that is held exclusively by the user. The IETF PKIX standards address these issues. New requests for certificates should be matched against certificates held in the directory to prevent the accidental obsolescence of valid public keys.