"Ideally it should be the location of all security configuration. I do encourage moving the configuration to the security subsystem."
The security subsystem is not available within the host controller process - this is the reason we can not use the security subsystem for domain management. Having some form of subsystem support in the host controller is part of the much longer term plan - at that point yes re-using the subsystem will be desirable to ensure a unified security configuration across the whole AS but as it stands today moving the items to it is just not practical.
Once subsystem support is available it would also be desirable to re-use the web susbystem to take advantage of any additional config there as well.
This is horrible for threaded discussions - any chance we could move this to a mail thread?