Perhaps most important is the issue of standards. In addition, the IETF's PKIX working group is defining a set of standards for an Internet PKI that should have a significant impact. As with most standards, the various PKI efforts have had their setbacks, both political and technical. There are a number of issues these groups have yet to resolve, mostly revolving around certificate management, with revocation being a significant issue. While it's clear that PKI systems will place revoked certificates on certificate revocation lists, how certificate authorities will maintain those lists, and how applications needing to validate certificates will access them, is the subject of much discussion.
Several methods look likely, but nothing has been decided.
Of course, there's more to an infrastructure than standards. If certificate management is integrated with user management through the directory, some of it can occur behind the scenes, transparent to system administrators. When an administrator creates a new directory ID for a user, he or she should have the option to automatically create a certificate for the user. Likewise, when administrators delete users from the directory, they should have the option of revoking that user's certificate. This brings us to another PKI prerequisite.