[spec] Client certificate scopes

[Omar Polo]

Adnan Maolood <me at adnano.co> writes:

> Currently, the Gemini specification requires client certificates be
> limited to the URL hostname and path for which they were requested. My
> Gemini client automatically generates certificates for the user, and
> this requirement makes it much more complicated to store and load
> certificates. For simplicity's sake, I propose that client certificates
> only be limited to the hostname for which they were requested.

Wouldn't this cause problems with multi-user capsules?  e.g. as a user,
if I used a certificate for gemini://example.com/~user1/cgi/foo I may
don't want that same certificate to be sent to
gemini://example.com/~user2/cgi/bar.

Maybe limiting them to a path AND all the descendant paths?  So that
/~user1/cgi/foo and /~user1/cgi/foo/bar are using the same cert by
default?