In section 3.1, the OID for id-dsa-with-sha256 doesn't match the OIDs in the ASN.1 module. I think it needs to be 2 vice 1 in the text.