Draft: draft-ietf-lamps-documentsigning-eku

Commentary: Addressing  ' . 
 Debating adding more context than just " document " .
There is no issue if the vendor-defined KeyPurposeIds are used in a
PKI governed by the vendor or a set of specific group of vendors.
However, if the KeyPurposeId is used outside of vendor governance,
the usage can easily become out of control.  For instance, when the
end user encounters certificates with vendor-defined KeyPurposeIds,
they might want to ask that vendor about use of the certificate.
However, if those certificates were not governed by the KeyPurposeIds
owner but by another vendor, the vender who own the KeyPurposeIds may
not able to control use, or even do not know about the use. - If the
issuance of the cert is not under the control of the KeyPurposeIds
owner, it is hard to estimate the impact of change to made on the
KeyPurposeId.  Changes related to KeyPurposeIds possibly make
negative impacts that some group of people do not tolerate, and it
could become a migration agility issue.
There is no issue if the vendor-defined KeyPurposeIds are used in a
PKI governed by the vendor or a set of specific group of vendors.
However, if the KeyPurposeId is used outside of vendor governance,
the usage can easily become out of control.  For instance, when the
end user encounters certificates with vendor-defined KeyPurposeIds,
they might want to ask that vendor about use of the certificate.
However, if those certificates were not governed by the KeyPurposeIds
owner but by another vendor, the vendor who own the KeyPurposeIds may
not able to control use, or even do not know about the use. - If the
issuance of the cert is not under the control of the KeyPurposeIds
owner, it is hard to estimate the impact of change to made on the
KeyPurposeId.  Changes related to KeyPurposeIds possibly make
negative impacts that some group of people do not tolerate, and it
could become a migration agility issue.
This procedure is intended to permit or prohibit presence of a
certain KeyPurposeId or complete absence of KeyPurposeIds.  It is
outside the scope of this document, but the relying party can
permit or prohibit combinations of KeyPurposeIds, instead of a
single KeyPurposeId.  A consideration on prohibiting combinations
of KeyPurposeIds is described in the Security Considerations
section of this document.  If both "Excluded KeyPurposeId" and
"Permitted KeyPurposeId" exists, the relying party or the relying
party software proresses each restriction on "Excluded
KeyPurposeId" first, and then processes each restriction on
"Permitted KeyPurposeId".
This procedure is intended to permit or prohibit presence of a
certain KeyPurposeId or complete absence of KeyPurposeIds.  It is
outside the scope of this document, but the relying party can
permit or prohibit combinations of KeyPurposeIds, instead of a
single KeyPurposeId.  A consideration on prohibiting combinations
of KeyPurposeIds is described in the Security Considerations
section of this document.  If both "Excluded KeyPurposeId" and
"Permitted KeyPurposeId" exists, the relying party or the relying
party software processes each restriction on "Excluded
KeyPurposeId" first, and then processes each restriction on
"Permitted KeyPurposeId".
When a single application has the capability to process various data
formats, the software may choose to make the excluded and permitted
decisions separately in accordance with the format it is handling
(e.g.  text, pdf, etc).
When a single application has the capability to process various data
formats, the software may choose to make the excluded and permitted
decisions separately in accordance with the format it is handling
(e.g., TEXT, PDF).