Peter,
The motivation for the comment was that we've just gone through the keyEncipherment vs. dataEncipherment debate where no-one's quite sure which bits to set for what occasion, and now in an attempt to fix the equally- problematic DS vs. NR we're creating a similar problem: [...]
Fair enough. Problem is we'll apparently never get agreement on what NR/CC means:-(
The digitalSignature bit is asserted when the subject public key is used for verifying digital signatures that are used with an entity authentication service, a data origin authentication service or/and an integrity service. Note that a certificate with only the digitalSignature bit set MUST NOT be used for verifying certificate or CRL signatures.Sounds good to me.
Cool. Let's see what happens when Denis get back so, Stephen.