CPS5.8.1 root secured for future revocations. AD2.3 refers. CPS5.8.1 CPS5.8.1 AD2.3 refers. CPS5.8.1 (no subscriber private keys are held by CA)