CARD: Details on signing unsolicited CARD Reply messages

"...Now unsolicited CARD replies are to be authenticated with signatures,
which MN can verify with the public key of the AR, that MN has learned
from somewhere. This is very vague. The description of CARD should be
sufficient for two implementations to be interoperable. IMO you should
either remove the whole unsolicited CARD reply functionality, or clarify
the use of signatures so that it will actually work between two
independent implementations."

To be honest, removing the advertisement of unsolicited CARD Replies
is not the solution I would support. The issue of authentication of
advertised messages is common to many other protocols. The question
is whether or not the CARD protocol spec sould be specific to a
solution. If there are more efficient solutions in the future, why
not keeping the flexibility to adopt the CARD protocol to that
mechanism?  

But I am also fine with adding some more details here. Any
proposals for details on a mechanisms?

marco