FIPS201 and the AIA CA-extension

["Anders Rundgren" <anders.rundgren@telia.com>]

RFC 3280   
   "The id-ad-caIssuers OID is used when the additional information lists
   CAs that have issued certificates *superior* to the CA that issued the
   certificate containing this extension.  The referenced CA issuers
   description is intended to aid certificate users in the selection of
   a certification path that terminates at a point trusted by the
   certificate user"

Assume I have a FIPS201 card (that as far as I can tell do not contain
any CA certificates at all), how can a TLS client locate the actual issuing
CA which is a requirement for the certificate filtering/selection to work[*]?

Anders

*] Unless the server downloads the entire path itself (as DNs) which
it cannot for "scheme" CAs where RPs do not have to have any
information about scheme subordinate CAs.