Message protection and key update

["Christopher Williams" <ccwilliams@xxxxxxxxxxxx>]

Consider the following scenario:

I am enrolled in a PKI and have a signing-key pair that I wish to update.  I
send a key update request containing a new public key.  I sign the message
using my old private key.  The request is granted by the CA so I send a
certificate confirm message.

I assume that I sign this message with my NEW private key.  Is this correct?

Also, does this signature provide implicit POP of the private key?  After
all, the signature is over the hash of a certificate containing the matching
public key.  If it does provide implicit POP, should the POP options be
expanded?

Christopher Williams

Software engineer, NetLexis Ltd.
Solutions for secure electronic commerce
http://www.netlexis.com