From 38596258e5d2d6a4f7b2d21d6ee897d3bf9d7bfe Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 5 Sep 2012 11:14:03 +0000
Subject: [PATCH] Implement Sara's idea for moving away from PKIX gradually:   
 * Remove all KeyName elements from imported metadata    * No longer ask for a
 KeyName to be added to certificates matching the remaining trust roots.

---
 build/check_embedded.pl | 2 +-
 mdx/uk/import.xsl       | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/build/check_embedded.pl b/build/check_embedded.pl
index 9ad429c9..1bcd5c44 100755
--- a/build/check_embedded.pl
+++ b/build/check_embedded.pl
@@ -353,7 +353,7 @@ sub comment {
 				$error = '';
 				comment("unknown issuer: $issuerCN");
 			} elsif ($clientOK) {
-				$error = "certificate matches trust fabric; add KeyName?";
+				# $error = "certificate matches trust fabric; add KeyName?";
 			}
 		}
 
diff --git a/mdx/uk/import.xsl b/mdx/uk/import.xsl
index af637d39..57abb4a8 100644
--- a/mdx/uk/import.xsl
+++ b/mdx/uk/import.xsl
@@ -235,9 +235,9 @@
 	<!--
 		ds:KeyName
 		
-		Remove empty KeyName elements.
+		Remove KeyName elements.
 	-->
-	<xsl:template match="ds:KeyName[.='']">
+	<xsl:template match="ds:KeyName">
 		<!-- do nothing -->
 	</xsl:template>