RE: URI security problems

["Edwards, Nigel" <Nigel_Edwards@hp.com>]

Hi Anders,
I now realize the linkage between the components of compound 
assertions is more secure than I had thought. As you pointed out,
if a URI appears in the <DependsOn> element, then the object to which 
the link refers must have the same URI embedded in its <ID> element. 
Both objects must have valid signatures.

I think this makes the security of the linkage between compound 
assertions independent of external components such as DNS, which 
is what I was worried about.

I had misunderstood the intended relationship between the <ID> and 
<DependsOn> element.

Thanks and regards,
Nigel.