> This profile does not restrict the combinations of bits that may be
> set in an instantiation of the keyUsage extension. However,
> valid combinations of bits are specified for particular algorithms
> in section 7.3.
Like I mentioned in a private exchange, I would add something to the effect
of "Although there are no key restrictions, implementers should be aware
that certain combinations do not make sense (i.e. keyAgreement for RSA keys,
keyExchange for ECC keys) and some combinations may 'be insecure' (or
'lessen the security')."
The sections that discuss each algorithm could state which bits may or may
not be set for that algorithm. In my view, algorithm specific information
should not be included in the discussion of this extension.