Quoting RFC4562, Cryptographic Message Syntax (CMS), section 5.6. Signature Verification Process:
The recipient MAY obtain the correct public key for the signer by any means, but the preferred method is from a certificate obtained from the SignedData certificates field.
The certificates field is a
SET OF CertificateChoices which can be any of the following:
The first two have a
subjectPublicKey field but the last three do not seem to. They have Attribute fields that could contain a
subjectPublicKey I suppose -- but if they don't it makes me wonder what the point of including them as possible choices is?