short-lived credential issuance

Greeting SACRED,

A question about a possible use case:

It seems that SACRED could be used for issuing short-lived credentials
(certs+keypairs).  To client software, there wouldn't be much difference
between retrieving a static, long-lived credential or getting a transient,
freshly-issued one.

Short-lived credentials are useful because they expire quickly so don't need
to be revoked, and don't need to be stored on the server (the server might
be stateless, and simply refer all authentications to a legacy auth server
like RADIUS).

SACRED isn't ideal for cert issuance.  A protocol designed for it, like
IPsec's PIC, can deal in certificate requests and thus allow the client to
keep secret his private key, and have input into the certificate contents.
But having a single, general protocol for client apps to retrieve either
static or transient credentials might cause people to use SACRED for this
anyways.

So should the SACRED protocol take this into account?  I'm not sure how,
maybe no changes are needed.  Maybe there could be a well-known selector
named "transient", for example.  

I'm just curious if this is worth thinking about further, or if it's out of
scope.  


Trevor