Re: Certificate requests for encryption keys

[Keith Brady <keith@xxxxxxxxxxxx>]

One approach is to make a CMP IR/IP pair for a signature key certificate
which will have the effect of creating an authenticated identity
(presumably). This information should be maintained at the CA and we can
then make a CR request, signed (or POP'ed) by the signature key with the
encryption key as the payload.

We are, of course, not POP'ing the encryption key but this probably
doesn't matter. 

One can do the same with PKCS#10 though you miss the option to use POP.

cheers,

Keith