RE: "You know that you've struck a nerve when someone pastes something in Times New Roman without typing directly within the editor."
Yes :) The editor box is tiny. You are not the target of the hornets however. It was a great topic, and (without you having any way of knowing) a heated internal conversation that has been ongoing for some time.
RE: "But the fact that no business model might exist that makes compliance-by-customization possible "
Actually, PA-DSS only applies to commercial applications. I posed this question directly to one of the PCI-SSC directors last year, and their standpoint is that if you are taking an application and performing modifications for usage in-house, then PABP no longer applies. The application instead falls under your PCI-DSS certification. We are currently doing some internal testing to see if DNN is even "PCI-Ready".
RE: "So, I am most interested in learning about what specific, unavoidable technical issues -- not able to be remediated through existing extension points"
Since DNN controls the authentication of users, data access layer, protection of administrative resource, security logging, and error handling (as well as the password forms, etc.), this puts the framework itself in the PA-DSS spotlight. Any function that is related to the "security environment" is potentially a PA-DSS sensitive area. Many of these can be bypassed by writing providers, writing data directly to the database, etc. etc., however it is either a) impractical, or b) impossible to completely remove DNN from the scope. DNN would require a complete external code audit to ensure that under no circumstances would the framework do anything that could impact PCI compliance.
As mentioned earlier as well, many of the challenges are not technical in nature. They are procedural. DNN has to commit and enforce approved secure development practices and be able to show evidence of those practices during any audit.
I've answered a lot of the technical details about PA-DSS/PABP/PCI in a draft document posted on our forums here: http://forums.aspdotnetstorefront.com/showthread.php?p=69754#post69754
One of the biggest issues to circumvent is still determining what is required when and muddling through the rediculous acronym list.