I sent a query re the DER encoding issue in the HoK Assertion Profile
to four external mailing lists. By far, the best responses were
received from members of the PKIX Working Group:
I'm unable to summarize this very long thread in a few short
sentences. I will, however, incorporate what I've learned in the next
version of the HoK Assertion Profile (which is forthcoming).