While the proposal is nice, it's a bit sad that the RFC invents its own serialization scheme instead of just using ASN.1, like everything else that touches X.509:
> The signature of the DelegatedCredential is computed over the concatenation of:
> 1. A string that consists of octet 32 (0x20) repeated 64 times.
> 2. The context string "TLS, server delegated credentials" for servers and "TLS, client delegated credentials" for clients.
> 3. A single 0 byte, which serves as the separator.
> 4. The DER-encoded X.509 end-entity certificate used to sign the DelegatedCredential.
> The signature of the DelegatedCredential is computed over the concatenation of:
> 1. A string that consists of octet 32 (0x20) repeated 64 times.
> 2. The context string "TLS, server delegated credentials" for servers and "TLS, client delegated credentials" for clients.
> 3. A single 0 byte, which serves as the separator.
> 4. The DER-encoded X.509 end-entity certificate used to sign the DelegatedCredential.
> 5. DelegatedCredential.cred.
https://tools.ietf.org/html/draft-ietf-tls-subcerts-04#secti...