🚀 go-pugleaf

Yes, your analysis is correct with the X.509 macros that use
cryptographic manipulations on the encoded ASN.1.  At the time
there was no alternative other than to invent a new type of 
ASN.1 encoding that would ensure the digitial signature operation
would work.  Although this appears like a defect, it is a pointer
to the new encoding rules that are being worked on.  I can't
remember all the names but there will be one to deal with the
problem X.509 identified.

The method used will probably not satisify the religious
zealots but I can verify from experience that you can build a
practical X.400 (1988) secure messaging system using these macros and
associated encoding rule restrictions.

Colin I'Anson - HP Labs Bristol