1. The picture outlines a fairly simple PKI structure (given in two formats). Based upon this structure, which CAs must B/Y/Z/A/C trust in order to find a path to A/C/Y? (Each letter is a client or user.)

2. If there is a revocation mechanism, why do certificates need an expirations date?

3. Why is it important in a good-list revocation scheme to keep hashes of the valid certificates, rather than just their serial numbers?

PKI Structure for HW #3 B/Y/Z A/B A/C B/Y/Z/A B/Y/Z/C A/C/Y A/B/X A/B/K B/Y/Z/A/C PKI Structure for HW #3 B/Y/Z A/B A/C B/Y/Z/A B/Y/Z/C A/C/Y A/B/X A/B/K B/Y/Z/A/C