###@###.### 2002-07-08

Sun's PKIX CertPathValidator implementation assumes that a CRL is signed by the
CA that issued the corresponding certificate. This may not always be the case.

Section 6.3.3, Step (f) of RFC 3280 states:

   (f) Obtain and validate the certification path for the complete CRL
   issuer. If a key usage extension is present in the CRL issuer's
   certificate, verify that the cRLSign bit is set.