A bit of background. Our organization is working on a document format that will be ingested by our software. We're using the CMS format to verify the integrity (by validating the signature). The CMS message format will contain the chain of the signer, and thus we will also use that to verify trust against the default system keychain (Java's cacerts in our case).
For our first release we'd like to verify that our organization is the one who has signed the document. Our team has looked into certificate pinning. In this case we would include a copy of the x509 certificate that we expect to be the singer and confirm (after we've done the signature validation and trust evaluation) that the signer equals the expected. We decided against it for a couple reasons. The biggest reason is that if a key was compromised or a cert expired we'd have to re-ship our software or make our users make a configuration change (switch the old cert for a new). We'd rather let a public CAs CRL take care of revocation for us.
One idea that we're leaning towards is to verify that the "organization" of the (verified) signers x509 subject is our organization. This seemed like a good compromise between certificate pinning and trusting anyone with a pre-trusted certificate.
In general, is it valid to trust the information that's provided in a certificate's subject if we trust the issuer of the certificate? I.E. Can I be positive that every Certificate Authority included within a non-compromised default trust store (again, Java's cacerts for us) will have verified the the organization that's listed in the subject is the actual organization? Does that extend to other subject fields such as state, local, email, etc? Outside of certificate pinning, is there a paradigm I'm missing that's meant to accomplish this sort of thing?