16856 need to check keyUsage for leaf certs
authorBrock Pytlik <brock.pytlik@oracle.com>
Tue, 08 Feb 2011 23:55:15 -0800
changeset 2215 b4355e8c5097
parent 2214 4908a492a0fb
child 2216 12747f6da813
16856 need to check keyUsage for leaf certs
.hgignore
doc/client_api_versions.txt
src/client.py
src/gui/modules/misc_non_gui.py
src/modules/actions/signature.py
src/modules/client/api.py
src/modules/client/api_errors.py
src/modules/client/publisher.py
src/modules/lint/engine.py
src/pkgdep.py
src/tests/api/t_api.py
src/tests/api/t_api_list.py
src/tests/cli/t_pkgsign.py
src/tests/pkg5unittest.py
src/tests/ro_data/signing_certs/generate_certs.py
src/tests/ro_data/signing_certs/openssl.cnf
src/tests/ro_data/signing_certs/produced/chain_certs/04.pem
src/tests/ro_data/signing_certs/produced/chain_certs/05.pem
src/tests/ro_data/signing_certs/produced/chain_certs/09.pem
src/tests/ro_data/signing_certs/produced/chain_certs/ch1_pubCA1_cert.pem
src/tests/ro_data/signing_certs/produced/chain_certs/ch2.2_pubCA1_cert.pem
src/tests/ro_data/signing_certs/produced/chain_certs/ch2_pubCA1_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/06.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/07.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/08.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/0A.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/0B.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/0D.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/0E.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/0F.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/10.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/11.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/12.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/13.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/14.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/15.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/16.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/17.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/18.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/19.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/1A.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/1B.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/1C.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/1D.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/1F.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/20.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/21.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/23.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/25.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_cs8_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p2_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p2_ta4_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p3_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p4_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p5_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_pubCA1_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta2_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta4_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta5_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_pubCA1_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_ta4_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_pubCA1_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_ta4_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs4_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs4_pubCA1_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs5_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs6_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs7_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/code_signing_certs/cs8_p1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/crl/ch1_pubCA1_crl.pem
src/tests/ro_data/signing_certs/produced/crl/pubCA1_ta1_crl.pem
src/tests/ro_data/signing_certs/produced/crl/pubCA1_ta4_crl.pem
src/tests/ro_data/signing_certs/produced/crl/pubCA2_ta4_crl.pem
src/tests/ro_data/signing_certs/produced/crl/ta5_crl.pem
src/tests/ro_data/signing_certs/produced/index
src/tests/ro_data/signing_certs/produced/inter_certs/01.pem
src/tests/ro_data/signing_certs/produced/inter_certs/02.pem
src/tests/ro_data/signing_certs/produced/inter_certs/i1_ta1_cert.pem
src/tests/ro_data/signing_certs/produced/inter_certs/i2_ta1_cert.pem
src/tests/ro_data/signing_certs/produced/keys/ch1_pubCA1_key.pem
src/tests/ro_data/signing_certs/produced/keys/ch2.2_pubCA1_key.pem
src/tests/ro_data/signing_certs/produced/keys/ch2_pubCA1_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_cs8_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_p2_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_p2_ta4_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_p3_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_p4_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_p5_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_pubCA1_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_ta2_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_ta4_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs1_ta5_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs2_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs2_pubCA1_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs2_ta4_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs3_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs3_pubCA1_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs3_ta4_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs4_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs4_pubCA1_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs5_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs6_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs7_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/cs8_p1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/i1_ta1_key.pem
src/tests/ro_data/signing_certs/produced/keys/i2_ta1_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta1_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta4_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta5_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA2_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA2_ta4_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA3_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA4_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/pubCA5_ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/ta1_key.pem
src/tests/ro_data/signing_certs/produced/keys/ta2_key.pem
src/tests/ro_data/signing_certs/produced/keys/ta3_key.pem
src/tests/ro_data/signing_certs/produced/keys/ta4_key.pem
src/tests/ro_data/signing_certs/produced/keys/ta5_key.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/03.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/0C.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/11.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/13.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/15.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/16.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/17.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/18.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/1A.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/1B.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/1C.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/1E.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/22.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/24.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta1_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta4_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta5_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA2_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA2_ta4_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA3_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA4_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA5_ta3_cert.pem
src/tests/ro_data/signing_certs/produced/serial
src/tests/ro_data/signing_certs/produced/ta1/ta1_cert.pem
src/tests/ro_data/signing_certs/produced/ta2/ta2_cert.pem
src/tests/ro_data/signing_certs/produced/ta3/ta3_cert.pem
src/tests/ro_data/signing_certs/produced/ta4/ta4_cert.pem
src/tests/ro_data/signing_certs/produced/ta5/ta5_cert.pem
src/tests/ro_data/signing_certs/produced/trust_anchors/ta1_cert.pem
src/tests/ro_data/signing_certs/produced/trust_anchors/ta2_cert.pem
src/tests/ro_data/signing_certs/produced/trust_anchors/ta3_cert.pem
src/tests/ro_data/signing_certs/produced/trust_anchors/ta4_cert.pem
src/tests/ro_data/signing_certs/produced/trust_anchors/ta5_cert.pem
src/util/distro-import/importer.py
--- a/.hgignore	Tue Feb 08 18:59:49 2011 -0800
+++ b/.hgignore	Tue Feb 08 23:55:15 2011 -0800
@@ -33,6 +33,9 @@
 ^src/pkg/Makefile.link
 ^src/pkg/pkgtmp/
 ^src/tests/.figleaf$
+^src/tests/ro_data/signing_certs/produced/.*/.*\.csr
+^src/tests/ro_data/signing_certs/produced/.*\.old
+^src/tests/ro_data/signing_certs/produced/.*\.tmp
 ^src/um/data/updatemanager-preferences.schemas$
 ^src/um/data/updatemanager.desktop$
 ^src/um/data/updatemanager.png$
--- a/doc/client_api_versions.txt	Tue Feb 08 18:59:49 2011 -0800
+++ b/doc/client_api_versions.txt	Tue Feb 08 23:55:15 2011 -0800
@@ -1,3 +1,16 @@
+Version 52:
+Incompatible with clients using versions 0-50:
+    pkg.client.publisher.Publisher has changed as follows:
+        * The following functions have been made private:
+            add_cert, get_certs_by_name, get_crl, check_extensions
+        * check_critical was removed.
+        * verify_chain had an additional, optional, argument added to it.  The
+          usages paramter defines what uses the certificate needs to allow.
+          If this parameter isn't set, then it's assumed that the certificate
+          should be able to be used for all known uses.
+        * The following constants were added to be used as values to the usages
+          parameter for verify chain.
+
 Version 51:
 Compatible with clients using versions 46-50:
     pkg.client.api.PlanDescription has changed as follows:
@@ -5,6 +18,11 @@
           error information for plan_*() functions.  See 'pydoc
           pkg.client.api' for details.
 
+Version 50:
+Compatible with clients using versions 46-50:
+    pkg.client.api.ImageInterface has changed as follows:
+        * plan_revert was added
+
 Version 49:
 Compatible with clients using versions 46-48:
     pkg.client.api.ImageInterface has changed as follows:
--- a/src/client.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/client.py	Tue Feb 08 23:55:15 2011 -0800
@@ -86,7 +86,7 @@
         import sys
         sys.exit(1)
 
-CLIENT_API_VERSION = 51
+CLIENT_API_VERSION = 52
 PKG_CLIENT_NAME = "pkg"
 
 JUST_UNKNOWN = 0
--- a/src/gui/modules/misc_non_gui.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/gui/modules/misc_non_gui.py	Tue Feb 08 23:55:15 2011 -0800
@@ -40,7 +40,7 @@
 
 # The current version of the Client API the PM, UM and
 # WebInstall GUIs have been tested against and are known to work with.
-CLIENT_API_VERSION = 49
+CLIENT_API_VERSION = 51
 LOG_DIR = "/var/tmp"
 LOG_ERROR_EXT = "_error.log"
 LOG_INFO_EXT = "_info.log"
--- a/src/modules/actions/signature.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/modules/actions/signature.py	Tue Feb 08 23:55:15 2011 -0800
@@ -21,7 +21,7 @@
 #
 
 #
-# Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2009, 2011, Oracle and/or its affiliates. All rights reserved.
 #
 
 import os
@@ -276,9 +276,13 @@
                 # to validate this signature are present.
                 self.get_chain_certs(pub)
                 try:
+                        # This import is placed here to break a circular
+                        # import seen when merge.py is used.
+                        from pkg.client.publisher import CODE_SIGNING_USE
                         # Verify the certificate whose key created this
                         # signature action.
-                        pub.verify_chain(cert, ca_dict, required_names)
+                        pub.verify_chain(cert, ca_dict, required_names,
+                            usages=CODE_SIGNING_USE)
                 except apx.SigningException, e:
                         e.act = self
                         raise
--- a/src/modules/client/api.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/modules/client/api.py	Tue Feb 08 23:55:15 2011 -0800
@@ -66,7 +66,7 @@
 from pkg.client.imageplan import EXECUTED_OK
 from pkg.client import global_settings
 
-CURRENT_API_VERSION = 51
+CURRENT_API_VERSION = 52
 CURRENT_P5I_VERSION = 1
 
 # Image type constants.
@@ -144,8 +144,7 @@
                 other platforms, a value of False will allow any image location.
                 """
 
-                compatible_versions = set([46, 47, 48, 49, 50,
-                    CURRENT_API_VERSION])
+                compatible_versions = set([CURRENT_API_VERSION])
 
                 if version_id not in compatible_versions:
                         raise apx.VersionException(CURRENT_API_VERSION,
--- a/src/modules/client/api_errors.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/modules/client/api_errors.py	Tue Feb 08 23:55:15 2011 -0800
@@ -1835,7 +1835,48 @@
                     "value:%(val)s") % {"cert": self.cert.get_subject(),
                     "name":self.ext.get_name(), "val":self.ext.get_value()}
 
-
+class UnsupportedExtensionValue(SigningException):
+        """Exception used when a certificate in the chain of trust has an
+        extension with a value pkg5 doesn't understand."""
+
+        def __init__(self, cert, ext, bad_val=None):
+                SigningException.__init__(self)
+                self.cert = cert
+                self.ext = ext
+                self.bad_val = bad_val
+
+        def __str__(self):
+                s = _("The certificate whose subject is %(cert)s could not be "
+                    "verified because it has an extension with a value that "
+                    "pkg(5) does not understand."
+                    "\nExtension name:%(name)s\nExtension value:%(val)s") % \
+                    {"cert": self.cert.get_subject(),
+                    "name":self.ext.get_name(), "val":self.ext.get_value()}
+                if self.bad_val:
+                        s += _("\nProblematic Value:%s") % (self.bad_val,)
+                return s
+
+class InappropriateCertificateUse(SigningException):
+        """Exception used when a certificate in the chain of trust has been used
+        inappropriately.  An example would be a certificate which was only
+        supposed to be used to sign code being used to sign other certificates.
+        """
+
+        def __init__(self, cert, ext, use):
+                SigningException.__init__(self)
+                self.cert = cert
+                self.ext = ext
+                self.use = use
+
+        def __str__(self):
+                return _("The certificate whose subject is %(cert)s could not "
+                    "be verified because it has been used inappropriately.  "
+                    "The way it is used means that the value for extension "
+                    "%(name)s must include '%(use)s' but the value was "
+                    "'%(val)s'.") % {"cert": self.cert.get_subject(),
+                    "use": self.use, "name":self.ext.get_name(),
+                    "val":self.ext.get_value()}
+                
 class InvalidPropertyValue(ApiException):
         """Exception used when a property was set to an invalid value."""
 
--- a/src/modules/client/publisher.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/modules/client/publisher.py	Tue Feb 08 23:55:15 2011 -0800
@@ -21,7 +21,7 @@
 #
 
 #
-# Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2009, 2011, Oracle and/or its affiliates. All rights reserved.
 #
 
 #
@@ -93,6 +93,28 @@
     URI_SORT_PRIORITY: lambda obj: (obj.priority, obj.uri),
 }
 
+# This dictionary records the recognized values of extensions.
+SUPPORTED_EXTENSION_VALUES = {
+    "basicConstraints": ("CA:TRUE", "CA:FALSE"),
+    "keyUsage": ("DIGITAL SIGNATURE", "CERTIFICATE SIGN", "CRL SIGN")
+}
+
+# These dictionaries map uses into their extensions.
+CODE_SIGNING_USE = {
+    "keyUsage": ["DIGITAL SIGNATURE"]
+}
+
+CERT_SIGNING_USE = {
+    "basicConstraints": ["CA:TRUE"],
+    "keyUsage": ["CERTIFICATE SIGN"]
+}
+
+CRL_SIGNING_USE = {
+    "keyUsage": ["CRL SIGN"]
+}
+
+POSSIBLE_USES = [CODE_SIGNING_USE, CERT_SIGNING_USE, CRL_SIGNING_USE]
+
 class RepositoryURI(object):
         """Class representing a repository URI and any transport-related
         information."""
@@ -1685,7 +1707,7 @@
                 old_verification_value = self.__verified_cas
                 # Mark that not all CA certs have been verified.
                 self.__verified_cas = False
-                hsh = self.add_cert(cert)
+                hsh = self.__add_cert(cert)
                 self.signing_ca_certs.append(hsh)
                 # If the user had previously removed this certificate, remove
                 # the certificate from that list.
@@ -1731,7 +1753,7 @@
                         t.remove(s)
                         self.revoked_ca_certs = list(t)
 
-        def add_cert(self, s):
+        def __add_cert(self, s):
                 """Add the certificate stored as a string in 's' to the
                 certificates this publisher knows about."""
 
@@ -1795,7 +1817,7 @@
                 assert not (verify_hash and only_retrieve)
                 pth = os.path.join(self.cert_root, pkg_hash)
                 if not os.path.exists(pth):
-                        self.add_cert(self.transport.get_content(self,
+                        self.__add_cert(self.transport.get_content(self,
                             pkg_hash))
                 if only_retrieve:
                         return None
@@ -1811,7 +1833,7 @@
                                     pth)
                 return c
 
-        def get_certs_by_name(self, name):
+        def __get_certs_by_name(self, name):
                 """Given 'name', a M2Crypto X509_Name, return the certs with
                 that name as a subject."""
 
@@ -1920,7 +1942,8 @@
                     set(self.revoked_ca_certs):
                         cert = self.get_cert_by_hash(c, verify_hash=True)
                         try:
-                                self.verify_chain(cert, trust_anchors)
+                                self.verify_chain(cert, trust_anchors,
+                                    usages=CERT_SIGNING_USE)
                         except api_errors.CertificateException:
                                 # If the cert couldn't be verified, add it to
                                 # the certs to ignore for this operation but
@@ -1956,7 +1979,7 @@
                                     "%s is not in a recognized format.") %
                                     pth)
 
-        def get_crl(self, uri):
+        def __get_crl(self, uri):
                 """Given a URI (for now only http URIs are supported), return
                 the CRL object created from the file stored at that uri."""
 
@@ -2025,7 +2048,7 @@
                 except LookupError, e:
                         return True
                 uri = ext.get_value()
-                crl = self.get_crl(uri)
+                crl = self.__get_crl(uri)
                 # If we couldn't retrieve a CRL from the distribution point
                 # and no CRL is cached on disk, assume the cert has not been
                 # revoked.  It's possible that this should be an image or
@@ -2039,14 +2062,24 @@
                 crl_issuer = crl.get_issuer()
                 tas = ca_dict.get(crl_issuer.as_hash(), [])
                 for t in tas:
-                        if crl.verify(t.get_pubkey()):
-                                verified_crl = True
+                        try:
+                                if crl.verify(t.get_pubkey()):
+                                        # If t isn't approved for signing crls,
+                                        # the exception __check_extensions
+                                        # raises will take the code to the
+                                        # except below.
+                                        self.__check_extensions(t,
+                                            CRL_SIGNING_USE)
+                                        verified_crl = True
+                        except api_errors.SigningException:
+                                pass
                 if not verified_crl:
-                        crl_cas = self.get_certs_by_name(crl_issuer)
+                        crl_cas = self.__get_certs_by_name(crl_issuer)
                         for c in crl_cas:
                                 if crl.verify(c.get_pubkey()):
                                         try:
-                                                self.verify_chain(c, ca_dict)
+                                                self.verify_chain(c, ca_dict,
+                                                    usages=CRL_SIGNING_USE)
                                         except api_errors.SigningException:
                                                 pass
                                         else:
@@ -2060,27 +2093,43 @@
                 if rev:
                         raise api_errors.RevokedCertificate(cert, rev[1])
 
-        def check_critical(self, ext):
-                """Check whether this criticial extension is supported."""
-
-                if ext.get_name() != "basicConstraints":
-                        return False
-                v = ext.get_value()
-                if v.upper() not in ("CA:TRUE", "CA:FALSE"):
-                        return False
-                return True
-
-        def check_extensions(self, cert):
+        def __check_extensions(self, cert, usages):
                 """Check whether the critical extensions in this certificate
-                are supported."""
+                are supported and allow the provided use(s)."""
 
                 for i in range(0, cert.get_ext_count()):
                         ext = cert.get_ext_at(i)
-                        if not ext.get_critical() or self.check_critical(ext):
-                                continue
-                        raise api_errors.UnsupportedCriticalExtension(cert, ext)
+                        name = ext.get_name()
+                        v = ext.get_value().upper()
+                        # Check whether the extension name is recognized.
+                        if name in SUPPORTED_EXTENSION_VALUES:
+                                supported_vs = \
+                                    SUPPORTED_EXTENSION_VALUES[name]
+                                vs = [s.strip() for s in v.split(",")]
+                                # Check whether the values for the extension are
+                                # recognized.
+                                for v in vs:
+                                        if v not in supported_vs:
+                                                if len(vs) < 2:
+                                                        raise api_errors.UnsupportedExtensionValue(cert, ext)
+                                                else:
+                                                        raise api_errors.UnsupportedExtensionValue(cert, ext, v)
+                                uses = usages.get(name, [])
+                                if isinstance(uses, basestring):
+                                        uses = [uses]
+                                # For each use, check to see whether it's
+                                # permitted by the certificate's extension
+                                # values.
+                                for u in uses:
+                                        if u not in vs:
+                                                raise api_errors.InappropriateCertificateUse(cert, ext, u)
+                        # If the extension name is unrecognized and critical,
+                        # then the chain cannot be verified.
+                        elif ext.get_critical():
+                                raise api_errors.UnsupportedCriticalExtension(
+                                    cert, ext)
         
-        def verify_chain(self, cert, ca_dict, required_names=None):
+        def verify_chain(self, cert, ca_dict, required_names=None, usages=None):
                 """Validates the certificate against the given trust anchors.
 
                 The 'cert' parameter is the certificate to validate.
@@ -2097,8 +2146,23 @@
                 continue_loop = True
                 certs_with_problems = []
 
+                def merge_dicts(d1, d2):
+                        """Function for merging usage dictionaries."""
+                        res = copy.deepcopy(d1)
+                        for k in d2:
+                                if k in res:
+                                        res[k].extend(d2[k])
+                                else:
+                                        res[k] = d2[k]
+                        return res
+
+                if not usages:
+                        usages = {}
+                        for u in POSSIBLE_USES:
+                                usages = merge_dicts(usages, u)
+
                 # Check whether we can validate this certificate.
-                self.check_extensions(cert)
+                self.__check_extensions(cert, usages)
 
                 # Check whether this certificate has been revoked.
                 self.__check_crls(cert, ca_dict)
@@ -2152,12 +2216,14 @@
                                 # this certificate but had critical extensions
                                 # we can't handle yet for error reporting.
                                 certs_with_problems = []
-                                for c in self.get_certs_by_name(issuer):
+                                for c in self.__get_certs_by_name(issuer):
                                         # If the certificate is approved to
                                         # sign another certificate, verifies
                                         # the current certificate, and hasn't
                                         # been revoked, consider it as the
-                                        # next link in the chain.
+                                        # next link in the chain.  check_ca
+                                        # checks both the basicConstraints
+                                        # extension and the keyUsage extension.
                                         if c.check_ca() and \
                                             cert.verify(c.get_pubkey()):
                                                 problem = False
@@ -2165,7 +2231,8 @@
                                                 # has a critical extension we
                                                 # don't understand.
                                                 try:
-                                                        self.check_extensions(c)
+                                                        self.__check_extensions(
+                                                            c, CERT_SIGNING_USE)
                                                         self.__check_crls(c,
                                                             ca_dict)
                                                 except (api_errors.UnsupportedCriticalExtension, api_errors.RevokedCertificate), e:
--- a/src/modules/lint/engine.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/modules/lint/engine.py	Tue Feb 08 23:55:15 2011 -0800
@@ -39,7 +39,7 @@
 import sys
 
 PKG_CLIENT_NAME = "pkglint"
-CLIENT_API_VERSION = 49
+CLIENT_API_VERSION = 52
 pkg.client.global_settings.client_name = PKG_CLIENT_NAME
 
 class LintEngineException(Exception):
--- a/src/pkgdep.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/pkgdep.py	Tue Feb 08 23:55:15 2011 -0800
@@ -41,7 +41,7 @@
 import pkg.publish.dependencies as dependencies
 from pkg.misc import msg, emsg, PipeError
 
-CLIENT_API_VERSION = 49
+CLIENT_API_VERSION = 51
 PKG_CLIENT_NAME = "pkgdepend"
 
 DEFAULT_SUFFIX = ".res"
--- a/src/tests/api/t_api.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/api/t_api.py	Tue Feb 08 23:55:15 2011 -0800
@@ -41,7 +41,7 @@
 import time
 import unittest
 
-CLIENT_API_VERSION = 49
+CLIENT_API_VERSION = 51
 PKG_CLIENT_NAME = "pkg"
 
 class TestPkgApi(pkg5unittest.SingleDepotTestCase):
--- a/src/tests/api/t_api_list.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/api/t_api_list.py	Tue Feb 08 23:55:15 2011 -0800
@@ -44,7 +44,7 @@
 import pkg.misc as misc
 import pkg.version as version
 
-CLIENT_API_VERSION = 49
+CLIENT_API_VERSION = 52
 PKG_CLIENT_NAME = "pkg"
 
 class TestApiList(pkg5unittest.ManyDepotTestCase):
--- a/src/tests/cli/t_pkgsign.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/cli/t_pkgsign.py	Tue Feb 08 23:55:15 2011 -0800
@@ -21,7 +21,7 @@
 #
 
 #
-# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
 #
 
 import testutils
@@ -1036,9 +1036,222 @@
                 api_obj = self.get_img_api_obj()
                 self.assertRaises(apx.BrokenChain, self._api_install, api_obj,
                     ["example_pkg"])
-                # Test that the cli handles a BrokenChain exception which
-                # contains other exceptions.
+
+        def test_inappropriate_use_of_code_signing_cert(self):
+                """Test that signing a certificate with a code signing
+                certificate results in a broken chain."""
+
+                ca_path = os.path.join(os.path.join(self.pub_cas_dir,
+                    "pubCA1_ta3_cert.pem"))
+                r = self.get_repo(self.dcs[1].get_repodir())
+                r.add_signing_certs([ca_path], ca=True)
+
+                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)
+                sign_args = "-k %(key)s -c %(cert)s -i %(i1)s %(name)s" % {
+                        "name": plist[0],
+                        "key": os.path.join(self.keys_dir,
+                            "cs1_cs8_p1_ta3_key.pem"),
+                        "cert": os.path.join(self.cs_dir,
+                            "cs1_cs8_p1_ta3_cert.pem"),
+                        "i1": os.path.join(self.cs_dir,
+                            "cs8_p1_ta3_cert.pem")
+                }
+                self.pkgsign(self.rurl1, sign_args)
+
+                self.pkg_image_create(self.rurl1)
+                self.seed_ta_dir("ta3")
+
+                self.pkg("set-property signature-policy verify")
+                api_obj = self.get_img_api_obj()
+                # This raises a BrokenChain exception because the certificate
+                # check_ca method checks the keyUsage extension if it's set
+                # as well as the basicConstraints extension.
+                self.assertRaises(apx.BrokenChain, self._api_install, api_obj,
+                    ["example_pkg"])
+                self.pkg("set-property signature-policy ignore")
+                api_obj = self.get_img_api_obj()
+                self._api_install(api_obj, ["example_pkg"])
+
+        def test_inappropriate_use_of_cert_signing_cert(self):
+                """Test that using a CA cert without the digitalSignature
+                value for the keyUsage extension to sign a package means
+                that the package's signature doesn't verify."""
+
+                ca_path = os.path.join(os.path.join(self.pub_cas_dir,
+                    "pubCA1_ta3_cert.pem"))
+                r = self.get_repo(self.dcs[1].get_repodir())
+                r.add_signing_certs([ca_path], ca=True)
+
+                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)
+                sign_args = "-k %(key)s -c %(cert)s %(name)s" % {
+                        "name": plist[0],
+                        "key": os.path.join(self.keys_dir,
+                            "pubCA1_ta3_key.pem"),
+                        "cert": os.path.join(self.pub_cas_dir,
+                            "pubCA1_ta3_cert.pem")
+                }
+                self.pkgsign(self.rurl1, sign_args)
+
+                self.pkg_image_create(self.rurl1)
+                self.seed_ta_dir("ta3")
+
+                self.pkg("set-property signature-policy verify")
+                api_obj = self.get_img_api_obj()
+                self.assertRaises(apx.InappropriateCertificateUse,
+                    self._api_install, api_obj, ["example_pkg"])
+                # Tests that the cli can handle an InappropriateCertificateUse
+                # exception.
                 self.pkg("install example_pkg", exit=1)
+                self.pkg("set-property signature-policy ignore")
+                api_obj = self.get_img_api_obj()
+                self._api_install(api_obj, ["example_pkg"])
+
+        def test_no_crlsign_on_revoking_ca(self):
+                """Test that if a CRL is signed with a CA that has the keyUsage
+                extension but not the cRLSign value is not considered a valid
+                CRL."""
+                
+                ca_path = os.path.join(os.path.join(self.pub_cas_dir,
+                    "pubCA2_ta4_cert.pem"))
+                r = self.get_repo(self.dcs[1].get_repodir())
+                r.add_signing_certs([ca_path], ca=True)
+
+                rstore = r.get_pub_rstore(pub="test")
+                os.makedirs(os.path.join(rstore.file_root, "pu"))
+                portable.copyfile(os.path.join(self.crl_dir,
+                    "pubCA2_ta4_crl.pem"),
+                    os.path.join(rstore.file_root, "pu", "pubCA2_ta4_crl.pem"))
+                
+                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)
+
+                sign_args = "-k %(key)s -c %(cert)s %(name)s" % {
+                        "name": plist[0],
+                        "key": os.path.join(self.keys_dir,
+                            "cs1_p2_ta4_key.pem"),
+                        "cert": os.path.join(self.cs_dir, "cs1_p2_ta4_cert.pem")
+                }
+                self.pkgsign(self.rurl1, sign_args)
+
+                self.dcs[1].start()
+                
+                self.pkg_image_create(self.durl1)
+                self.seed_ta_dir("ta4")
+
+                self.pkg("set-property signature-policy require-signatures")
+                api_obj = self.get_img_api_obj()
+                # This succeeds because the CA which signed the revoking CRL
+                # did not have the cRLSign keyUsage extension set.
+                self._api_install(api_obj, ["example_pkg"])
+
+        def test_unknown_value_for_non_critical_extension(self):
+                """Test that an unknown value for a recognized non-critical
+                extension causes an exception to be raised."""
+
+                ca_path = os.path.join(os.path.join(self.pub_cas_dir,
+                    "pubCA1_ta3_cert.pem"))
+                r = self.get_repo(self.dcs[1].get_repodir())
+                r.add_signing_certs([ca_path], ca=True)
+
+                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)
+                sign_args = "-k %(key)s -c %(cert)s %(name)s" % {
+                        "name": plist[0],
+                        "key": os.path.join(self.keys_dir,
+                            "cs5_p1_ta3_key.pem"),
+                        "cert": os.path.join(self.cs_dir, "cs5_p1_ta3_cert.pem")
+                }
+                self.pkgsign(self.rurl1, sign_args)
+
+                self.pkg_image_create(self.rurl1)
+                self.seed_ta_dir("ta3")
+
+                self.pkg("set-property signature-policy verify")
+                api_obj = self.get_img_api_obj()
+                self.assertRaises(apx.UnsupportedExtensionValue,
+                    self._api_install, api_obj, ["example_pkg"])
+                # Tests that the cli can handle an UnsupportedCriticalExtension.
+                self.pkg("install example_pkg", exit=1)
+                self.pkg("set-property signature-policy ignore")
+                api_obj = self.get_img_api_obj()
+                self._api_install(api_obj, ["example_pkg"])
+
+        def test_unknown_value_for_critical_extension(self):
+                """Test that an unknown value for a recognized critical
+                extension causes an exception to be raised."""
+
+                ca_path = os.path.join(os.path.join(self.pub_cas_dir,
+                    "pubCA1_ta3_cert.pem"))
+                r = self.get_repo(self.dcs[1].get_repodir())
+                r.add_signing_certs([ca_path], ca=True)
+
+                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)
+                sign_args = "-k %(key)s -c %(cert)s %(name)s" % {
+                        "name": plist[0],
+                        "key": os.path.join(self.keys_dir,
+                            "cs6_p1_ta3_key.pem"),
+                        "cert": os.path.join(self.cs_dir, "cs6_p1_ta3_cert.pem")
+                }
+                self.pkgsign(self.rurl1, sign_args)
+
+                self.pkg_image_create(self.rurl1)
+                self.seed_ta_dir("ta3")
+
+                self.pkg("set-property signature-policy verify")
+                api_obj = self.get_img_api_obj()
+                self.assertRaises(apx.UnsupportedExtensionValue,
+                    self._api_install, api_obj, ["example_pkg"])
+                self.pkg("set-property signature-policy ignore")
+                api_obj = self.get_img_api_obj()
+                self._api_install(api_obj, ["example_pkg"])
+
+        def test_unset_keyUsage_for_code_signing(self):
+                """Test that if keyUsage has not been set, the code signing
+                certificate is considered valid."""
+
+                ca_path = os.path.join(os.path.join(self.pub_cas_dir,
+                    "pubCA1_ta3_cert.pem"))
+                r = self.get_repo(self.dcs[1].get_repodir())
+                r.add_signing_certs([ca_path], ca=True)
+
+                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)
+                sign_args = "-k %(key)s -c %(cert)s %(name)s" % {
+                        "name": plist[0],
+                        "key": os.path.join(self.keys_dir,
+                            "cs7_p1_ta3_key.pem"),
+                        "cert": os.path.join(self.cs_dir, "cs7_p1_ta3_cert.pem")
+                }
+                self.pkgsign(self.rurl1, sign_args)
+
+                self.pkg_image_create(self.rurl1)
+                self.seed_ta_dir("ta3")
+
+                self.pkg("set-property signature-policy verify")
+                api_obj = self.get_img_api_obj()
+                self._api_install(api_obj, ["example_pkg"])
+
+        def test_unset_keyUsage_for_cert_signing(self):
+                """Test that if keyUsage has not been set, the CA certificate is
+                considered valid."""
+
+                ca_path = os.path.join(os.path.join(self.pub_cas_dir,
+                    "pubCA5_ta3_cert.pem"))
+                r = self.get_repo(self.dcs[1].get_repodir())
+                r.add_signing_certs([ca_path], ca=True)
+
+                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)
+                sign_args = "-k %(key)s -c %(cert)s %(name)s" % {
+                        "name": plist[0],
+                        "key": os.path.join(self.keys_dir,
+                            "cs1_p5_ta3_key.pem"),
+                        "cert": os.path.join(self.cs_dir, "cs1_p5_ta3_cert.pem")
+                }
+                self.pkgsign(self.rurl1, sign_args)
+
+                self.pkg_image_create(self.rurl1)
+                self.seed_ta_dir("ta3")
+
+                self.pkg("set-property signature-policy verify")
+                api_obj = self.get_img_api_obj()
+                self._api_install(api_obj, ["example_pkg"])
 
         def test_sign_no_server_update(self):
                 """Test that packages signed using private keys function
--- a/src/tests/pkg5unittest.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/pkg5unittest.py	Tue Feb 08 23:55:15 2011 -0800
@@ -98,7 +98,7 @@
 
 # Version test suite is known to work with.
 PKG_CLIENT_NAME = "pkg"
-CLIENT_API_VERSION = 49
+CLIENT_API_VERSION = 51
 
 ELIDABLE_ERRORS = [ TestSkippedException, depotcontroller.DepotStateException ]
 
--- a/src/tests/ro_data/signing_certs/generate_certs.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/generate_certs.py	Tue Feb 08 23:55:15 2011 -0800
@@ -21,7 +21,7 @@
 #
 
 #
-# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
 #
 
 import os
@@ -234,6 +234,23 @@
         # Add a certificate to the length 3 chain that is in the future.
         make_cs_cert("code_signing_certs", "cs4_p1_ta3",
             "publisher_cas", "pubCA1_ta3", future=True)
+        # Add a certificate to the length 3 chain that has an unknown value for
+        # a recognized non-critical extension.
+        make_cs_cert("code_signing_certs", "cs5_p1_ta3",
+            "publisher_cas", "pubCA1_ta3", ext="issuer_ext_non_critical")
+        # Add a certificate to the length 3 chain that has an unknown value for
+        # a recognized critical extension.
+        make_cs_cert("code_signing_certs", "cs6_p1_ta3",
+            "publisher_cas", "pubCA1_ta3", ext="issuer_ext_bad_val")
+        # Add a certificate to the length 3 chain that has keyUsage information
+        # but cannot be used to sign code.
+        make_cs_cert("code_signing_certs", "cs7_p1_ta3",
+            "publisher_cas", "pubCA1_ta3", ext="v3_no_keyUsage")
+        # Make a chain where a CS is used to sign another CS.
+        make_cs_cert("code_signing_certs", "cs8_p1_ta3",
+            "publisher_cas", "pubCA1_ta3", ext="v3_confused_cs")
+        make_cs_cert("code_signing_certs", "cs1_cs8_p1_ta3",
+            "code_signing_certs", "cs8_p1_ta3")
         # Make a chain where the CA has an unsupported critical extension.
         make_ca_cert("publisher_cas", "pubCA2_ta3", "trust_anchors", "ta3",
             ext="issuer_ext_ca")
@@ -249,6 +266,11 @@
             future=True)
         make_cs_cert("code_signing_certs", "cs1_p4_ta3",
             "publisher_cas", "pubCA4_ta3")
+        # Make a chain where the CA does not have keyUsage set.
+        make_ca_cert("publisher_cas", "pubCA5_ta3", "trust_anchors", "ta3",
+            future=True, ext="v3_ca_no_keyUsage")
+        make_cs_cert("code_signing_certs", "cs1_p5_ta3",
+            "publisher_cas", "pubCA5_ta3")
 
         # Revoke a code signing certificate from the publisher.
         make_trust_anchor("ta4")
@@ -260,6 +282,13 @@
             "publisher_cas", "pubCA1_ta4", ext="bad_crl")
         make_cs_cert("code_signing_certs", "cs3_ta4",
             "publisher_cas", "pubCA1_ta4", ext="bad_crl_loc")
+        # Revoke a code signing certificate but sign the CRL with a CA
+        # certificate that does not have that keyUsage set.
+        make_ca_cert("publisher_cas", "pubCA2_ta4", "trust_anchors", "ta4",
+            ext="v3_ca_no_crl")
+        make_cs_cert("code_signing_certs", "cs1_p2_ta4",
+            "publisher_cas", "pubCA2_ta4", ext="pubCA2_ta4_crl")
+        revoke_cert("pubCA2_ta4", "cs1_p2_ta4", ca_dir="publisher_cas")
 
         # Revoke a CA cert from the trust anchor
         make_trust_anchor("ta5")
--- a/src/tests/ro_data/signing_certs/openssl.cnf	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/openssl.cnf	Tue Feb 08 23:55:15 2011 -0800
@@ -20,7 +20,7 @@
 #
 
 #
-# Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
 #
 
 # OpenSSL configuration file for use with generate_certs.py.
@@ -89,12 +89,46 @@
 # Extensions to add to a certificate request
 
 basicConstraints = critical,CA:FALSE
-keyUsage = digitalSignature
+keyUsage = critical, digitalSignature
+
+[ v3_confused_cs ]
+
+# Have CA be true, but don't have keyUsage allow certificate signing to created
+# a confused certificate
+
+basicConstraints = critical,CA:true
+keyUsage = critical, digitalSignature
+
+[ v3_no_keyUsage ]
+
+# The extensions to use for a code signing certificate without a keyUsage
+# extension
+
+basicConstraints = critical,CA:FALSE
 
 [ v3_ca ]
 
+# Extensions for a typical CA
 
-# Extensions for a typical CA
+# PKIX recommendation.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+basicConstraints = critical,CA:true
+keyUsage = critical, keyCertSign, cRLSign
+
+[ v3_ca_no_crl ]
+
+# Extensions for a CA which cannot sign a CRL.
+
+# PKIX recommendation.
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid:always,issuer:always
+basicConstraints = critical,CA:true
+keyUsage = critical, keyCertSign
+
+[ v3_ca_no_keyUsage ]
+
+# Extensions for a CA without keyUsage information.
 
 # PKIX recommendation.
 subjectKeyIdentifier=hash
@@ -115,6 +149,20 @@
 basicConstraints = critical,CA:TRUE
 issuerAltName = critical,issuer:copy
 
+[ issuer_ext_non_critical ]
+
+# Used to test a recognized non-critical extension with an unrecognized value
+
+basicConstraints = critical,CA:FALSE
+keyUsage = encipherOnly
+
+[ issuer_ext_bad_val ]
+
+# Used to test a recognized critical extension with an unrecognized value
+
+basicConstraints = critical,CA:FALSE
+keyUsage = critical, encipherOnly
+
 [ crl_ext ]
 
 # Used for testing certificate revocation.
@@ -129,6 +177,13 @@
 basicConstraints = critical,CA:FALSE
 crlDistributionPoints = URI:http://localhost:12001/file/0/pubCA1_ta1_crl.pem
 
+[ pubCA2_ta4_crl ]
+
+# Used for testing certificate revocation.
+
+basicConstraints = critical,CA:FALSE
+crlDistributionPoints = URI:http://localhost:12001/file/0/pubCA2_ta4_crl.pem
+
 [ ch1_ta1_crl ]
 
 # Used for testing certificate revocation at the level of a chain certificate.
@@ -145,6 +200,7 @@
 authorityKeyIdentifier=keyid:always,issuer:always
 basicConstraints = critical,CA:true
 crlDistributionPoints = URI:http://localhost:12001/file/0/ta5_crl.pem
+keyUsage = critical, keyCertSign, cRLSign
 
 [ bad_crl ]
 
--- a/src/tests/ro_data/signing_certs/produced/chain_certs/04.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/chain_certs/04.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,59 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta1/emailAddress=pubCA1_ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch1_pubCA1/emailAddress=ch1_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:df:49:4c:8c:dd:25:e1:4d:81:08:01:65:e4:37:
-                    db:d4:87:be:f1:ca:f3:c2:e5:82:b0:d2:c9:09:a4:
-                    3d:41:2a:c9:40:c5:55:aa:0b:8f:41:42:82:3c:2e:
-                    47:23:23:88:e5:55:7e:3f:71:ae:c9:f9:d8:bf:b9:
-                    e0:4b:74:6d:82:af:20:f0:8c:03:4b:fb:d9:40:99:
-                    bf:94:90:f9:00:36:be:a7:97:0d:af:6f:e3:e6:43:
-                    0c:22:a7:2b:92:dd:24:8f:78:2e:dd:5a:6d:05:77:
-                    b6:16:d1:8a:07:4f:a1:af:71:c3:7a:b4:d3:54:2e:
-                    f5:9a:d3:b1:40:7f:e0:35:71
+                    00:d8:64:e4:d7:2c:48:51:df:1e:a5:e3:ba:8e:d9:
+                    11:9e:05:43:4c:17:20:37:93:c9:95:40:08:50:c7:
+                    ed:a7:20:8f:51:fe:45:b6:d5:e6:5b:f5:30:bb:95:
+                    95:2e:c9:cc:3d:b6:7d:07:55:7a:ec:36:4b:92:c8:
+                    cd:97:b4:0e:72:43:22:dd:3b:bc:1f:7e:9a:de:5d:
+                    97:3f:cb:48:08:c8:20:64:59:d9:db:88:3a:3c:3d:
+                    6d:1f:57:42:c0:17:b3:67:1d:3c:1b:1a:53:02:0d:
+                    8c:af:91:89:7b:4c:13:49:77:5d:c1:56:80:2b:a2:
+                    5c:79:c7:c6:c1:61:95:4a:35
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                D1:05:EC:55:23:1D:1E:53:EC:AE:71:88:8C:12:C2:AE:14:FE:12:5E
+                C6:B5:AB:18:BB:95:31:CE:CA:76:FC:4A:0E:4A:67:25:0D:6A:2B:8B
             X509v3 Authority Key Identifier: 
-                keyid:E8:81:62:06:D5:A6:C6:2E:6C:2A:4F:A3:21:42:59:CD:19:5B:32:ED
+                keyid:F1:31:DD:AE:13:EF:6C:62:A3:83:98:4D:1F:0D:25:1A:21:28:1E:5D
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i2_ta1/emailAddress=i2_ta1
                 serial:03
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        75:00:7d:53:6d:fb:70:10:81:5c:71:2e:c9:17:29:7b:fb:b8:
-        b0:97:c4:49:79:44:9e:ab:50:b5:65:aa:fe:99:18:2d:29:af:
-        8d:72:77:72:aa:ca:a5:1e:47:a9:a1:8d:a2:f5:10:ec:d5:a4:
-        95:d9:e0:1f:37:94:c3:e5:c5:75:17:d5:00:55:a5:d9:7c:38:
-        c2:07:18:b3:f3:48:33:15:7c:25:2d:61:16:71:a1:dc:7f:82:
-        85:c0:af:62:48:cf:ca:29:69:23:c5:cc:9e:dd:fa:40:3f:b9:
-        b5:1c:82:41:fa:53:50:f9:03:eb:42:de:a5:b4:bd:78:01:dc:
-        86:9b
+        6b:c1:e0:d3:b6:d9:9f:b5:a4:fd:37:99:77:76:4a:55:ee:4e:
+        e6:90:6e:98:77:87:56:cc:6f:a8:4d:2b:11:06:e6:bf:66:9d:
+        8f:21:b7:06:bd:1d:1f:df:12:49:41:84:86:ff:e0:19:6a:f0:
+        29:28:dd:d4:45:bd:19:af:f6:67:32:20:1d:af:fa:d4:f8:6e:
+        00:cd:32:c4:ca:62:f9:89:b1:85:21:a6:5c:cc:11:60:b4:50:
+        3b:40:fb:cd:d2:eb:72:f7:f1:26:94:4d:a6:5a:81:e9:67:d2:
+        0c:7d:d6:7f:ee:8a:83:a9:7c:9e:65:b2:c6:67:ef:ef:2b:a6:
+        2d:a6
 -----BEGIN CERTIFICATE-----
-MIIDMTCCApqgAwIBAgIBBDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIIDQTCCAqqgAwIBAgIBBDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMTEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMTAeFw0xMDA4MDQyMDU5MjNaFw0xMzA0MzAyMDU5MjNaMHYxCzAJBgNV
+Q0ExX3RhMTAeFw0xMTAxMjgwMjU0MTBaFw0xMzEwMjQwMjU0MTBaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjaDFfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjaDFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfSUyM
-3SXhTYEIAWXkN9vUh77xyvPC5YKw0skJpD1BKslAxVWqC49BQoI8LkcjI4jlVX4/
-ca7J+di/ueBLdG2CryDwjANL+9lAmb+UkPkANr6nlw2vb+PmQwwipyuS3SSPeC7d
-Wm0Fd7YW0YoHT6GvccN6tNNULvWa07FAf+A1cQIDAQABo4HOMIHLMB0GA1UdDgQW
-BBTRBexVIx0eU+yucYiMEsKuFP4SXjCBmAYDVR0jBIGQMIGNgBTogWIG1abGLmwq
-T6MhQlnNGVsy7aFypHAwbjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
+AQkBFgpjaDFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYZOTX
+LEhR3x6l47qO2RGeBUNMFyA3k8mVQAhQx+2nII9R/kW21eZb9TC7lZUuycw9tn0H
+VXrsNkuSyM2XtA5yQyLdO7wffpreXZc/y0gIyCBkWdnbiDo8PW0fV0LAF7NnHTwb
+GlMCDYyvkYl7TBNJd13BVoArolx5x8bBYZVKNQIDAQABo4HeMIHbMB0GA1UdDgQW
+BBTGtasYu5Uxzsp2/EoOSmclDWorizCBmAYDVR0jBIGQMIGNgBTxMd2uE+9sYqOD
+mE0fDSUaISgeXaFypHAwbjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
 aWExEzARBgNVBAcTCk1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDzANBgNVBAMU
 BmkyX3RhMTEVMBMGCSqGSIb3DQEJARYGaTJfdGExggEDMA8GA1UdEwEB/wQFMAMB
-Af8wDQYJKoZIhvcNAQELBQADgYEAdQB9U237cBCBXHEuyRcpe/u4sJfESXlEnqtQ
-tWWq/pkYLSmvjXJ3cqrKpR5HqaGNovUQ7NWkldngHzeUw+XFdRfVAFWl2Xw4wgcY
-s/NIMxV8JS1hFnGh3H+ChcCvYkjPyilpI8XMnt36QD+5tRyCQfpTUPkD60LepbS9
-eAHchps=
+Af8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAGvB4NO22Z+1pP03
+mXd2SlXuTuaQbph3h1bMb6hNKxEG5r9mnY8htwa9HR/fEklBhIb/4Blq8Cko3dRF
+vRmv9mcyIB2v+tT4bgDNMsTKYvmJsYUhplzMEWC0UDtA+83S63L38SaUTaZageln
+0gx91n/uioOpfJ5lssZn7+8rpi2m
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/chain_certs/05.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/chain_certs/05.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,59 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch1_pubCA1/emailAddress=ch1_pubCA1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b1:17:94:03:99:12:09:1e:f2:3f:76:e3:63:11:
-                    75:3c:41:46:ca:3f:2c:9d:2f:e3:2f:39:90:63:a1:
-                    d0:31:e1:b7:eb:94:f3:c5:7c:2b:4a:da:9b:d2:28:
-                    29:68:72:4e:c8:53:0c:84:9b:6b:a1:7d:63:49:3b:
-                    65:e6:be:11:a5:ba:41:5e:74:0d:16:ae:95:26:02:
-                    79:ca:38:df:13:e9:f7:97:52:cd:d3:85:49:ec:cf:
-                    75:cd:54:13:f0:15:0d:65:ee:ea:e5:7b:3b:63:3e:
-                    5f:a9:4b:56:d3:10:1d:9b:47:ed:2f:46:54:53:19:
-                    b0:2e:63:cd:12:f4:40:4a:6b
+                    00:ec:10:82:b8:bd:a9:12:9e:70:2e:52:89:62:d7:
+                    8d:9c:a4:01:07:27:ee:20:92:6e:07:1e:dd:58:98:
+                    5b:65:6f:85:1b:b0:cd:e7:6d:f6:b3:9b:bd:1f:be:
+                    93:09:79:b6:f8:0a:45:8c:c4:b8:22:a3:fb:ad:96:
+                    03:6b:0f:18:b6:fa:d3:b5:35:99:92:a3:82:a2:71:
+                    93:ba:76:e4:ba:f6:87:2f:e8:a2:ed:2b:0c:a7:e4:
+                    bf:ae:9c:03:08:8a:1e:29:25:66:72:14:f1:99:05:
+                    2c:29:14:4d:59:b8:71:d6:95:78:48:7d:a3:b9:8f:
+                    eb:9e:e9:7c:b8:5c:65:5b:e7
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                3D:8C:8F:DF:07:E7:F3:5E:C1:50:68:37:8B:8A:DB:BD:15:5B:4C:2E
+                A2:7C:37:64:6C:9B:F6:34:69:35:2F:6E:2A:03:57:1C:DD:C7:69:60
             X509v3 Authority Key Identifier: 
-                keyid:D1:05:EC:55:23:1D:1E:53:EC:AE:71:88:8C:12:C2:AE:14:FE:12:5E
+                keyid:C6:B5:AB:18:BB:95:31:CE:CA:76:FC:4A:0E:4A:67:25:0D:6A:2B:8B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta1/emailAddress=pubCA1_ta1
                 serial:04
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        aa:60:e0:f8:bb:6d:07:de:5a:d1:58:07:27:64:29:68:49:2b:
-        42:67:25:da:c0:dc:52:82:98:b8:1b:79:a9:65:2a:fe:c7:78:
-        46:ca:76:1a:fe:b0:b1:9f:2f:d3:4c:4b:02:65:39:57:2a:a1:
-        48:ba:6b:9d:f7:67:80:70:8f:38:00:0f:4e:b2:57:ac:59:ad:
-        97:b7:46:67:39:3d:75:12:ff:8f:ac:d9:65:0f:a7:05:a5:1e:
-        49:94:a5:a1:44:4f:e7:ba:b9:af:5d:2c:3d:29:cd:a2:e2:c5:
-        2c:ac:1f:1e:7f:64:bf:97:d4:a9:6c:d1:91:9c:50:20:af:50:
-        ad:6b
+        8f:da:b0:83:87:60:1c:12:43:c5:37:e3:09:36:f2:5b:b2:e8:
+        36:eb:d5:c6:00:30:22:8c:e0:33:6a:61:8b:1b:45:d3:b4:e3:
+        c0:05:54:ef:52:1e:d1:41:f5:7d:c2:3b:0d:24:d5:78:bf:f1:
+        93:ad:32:c5:66:8c:3b:84:0d:f7:0b:e4:08:2c:bf:10:47:09:
+        02:18:d4:19:40:f1:18:af:c1:38:90:89:b1:a2:48:d2:b1:4d:
+        f9:ad:86:f2:64:cc:35:fb:35:87:25:49:2b:e3:29:23:f3:fd:
+        47:55:4c:2d:05:c3:c4:5b:75:27:4a:45:2a:e2:7f:5b:c5:b8:
+        97:78
 -----BEGIN CERTIFICATE-----
-MIIDOTCCAqKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIIDSTCCArKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gxX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gx
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjNaFw0xMzA0MzAyMDU5MjNaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTBaFw0xMzEwMjQwMjU0MTBaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjaDJfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjaDJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxF5QD
-mRIJHvI/duNjEXU8QUbKPyydL+MvOZBjodAx4bfrlPPFfCtK2pvSKClock7IUwyE
-m2uhfWNJO2XmvhGlukFedA0WrpUmAnnKON8T6feXUs3ThUnsz3XNVBPwFQ1l7url
-eztjPl+pS1bTEB2bR+0vRlRTGbAuY80S9EBKawIDAQABo4HWMIHTMB0GA1UdDgQW
-BBQ9jI/fB+fzXsFQaDeLitu9FVtMLjCBoAYDVR0jBIGYMIGVgBTRBexVIx0eU+yu
-cYiMEsKuFP4SXqF6pHgwdjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
+AQkBFgpjaDJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDsEIK4
+vakSnnAuUoli142cpAEHJ+4gkm4HHt1YmFtlb4UbsM3nbfazm70fvpMJebb4CkWM
+xLgio/utlgNrDxi2+tO1NZmSo4KicZO6duS69ocv6KLtKwyn5L+unAMIih4pJWZy
+FPGZBSwpFE1ZuHHWlXhIfaO5j+ue6Xy4XGVb5wIDAQABo4HmMIHjMB0GA1UdDgQW
+BBSifDdkbJv2NGk1L24qA1cc3cdpYDCBoAYDVR0jBIGYMIGVgBTGtasYu5Uxzsp2
+/EoOSmclDWori6F6pHgwdjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
 aWExEzARBgNVBAcTCk1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxEzARBgNVBAMU
 CnB1YkNBMV90YTExGTAXBgkqhkiG9w0BCQEWCnB1YkNBMV90YTGCAQQwDwYDVR0T
-AQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQCqYOD4u20H3lrRWAcnZCloSStC
-ZyXawNxSgpi4G3mpZSr+x3hGynYa/rCxny/TTEsCZTlXKqFIumud92eAcI84AA9O
-slesWa2Xt0ZnOT11Ev+PrNllD6cFpR5JlKWhRE/nurmvXSw9Kc2i4sUsrB8ef2S/
-l9SpbNGRnFAgr1Ctaw==
+AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAj9qw
+g4dgHBJDxTfjCTbyW7LoNuvVxgAwIozgM2phixtF07TjwAVU71Ie0UH1fcI7DSTV
+eL/xk60yxWaMO4QN9wvkCCy/EEcJAhjUGUDxGK/BOJCJsaJI0rFN+a2G8mTMNfs1
+hyVJK+MpI/P9R1VMLQXDxFt1J0pFKuJ/W8W4l3g=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/chain_certs/09.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/chain_certs/09.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch1_pubCA1/emailAddress=ch1_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2.2_pubCA1/emailAddress=ch2.2_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b8:4f:d8:46:38:cf:4d:f8:68:64:10:4a:2f:8b:
-                    2c:d6:5f:89:32:44:90:89:25:76:ff:54:65:59:d2:
-                    75:86:d0:94:cf:2d:f0:94:18:23:32:fd:ce:f4:6b:
-                    a0:c7:0e:f9:aa:18:f9:0b:fe:e7:85:aa:ff:8a:e1:
-                    04:53:f9:a4:34:75:45:07:6f:f1:80:06:ca:c3:0f:
-                    3b:b4:45:97:fe:09:f5:17:18:6c:05:e9:34:68:b9:
-                    de:61:a3:ac:e1:22:0f:69:72:6f:a9:a8:64:cb:89:
-                    a3:3d:32:02:25:64:5f:49:1e:0f:50:47:14:f2:0a:
-                    bf:8c:72:57:44:f9:2e:9e:69
+                    00:c8:33:0b:b1:2a:41:42:8c:70:88:60:cd:52:0e:
+                    ac:43:d5:65:9d:4a:29:4d:e6:32:9d:a7:ae:0e:dd:
+                    0c:68:3e:bd:0b:51:77:53:7d:c8:1d:49:a2:19:23:
+                    95:41:b4:9b:1f:89:fb:21:9c:f8:2b:e3:65:c3:17:
+                    22:cb:c6:f6:b4:cd:92:ae:a6:b1:f4:41:78:9e:0d:
+                    4c:4b:36:39:a4:8d:a9:2a:11:1e:08:1a:83:f6:3d:
+                    36:ab:d2:c7:48:e7:c7:7d:53:54:6a:a0:05:ca:5e:
+                    8d:b9:7f:eb:91:64:38:ec:32:0f:69:66:15:52:6a:
+                    2d:bd:5f:18:71:99:d4:1e:1d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,27 +29,27 @@
                 <EMPTY>
 
     Signature Algorithm: sha256WithRSAEncryption
-        9c:a9:be:da:f7:df:71:83:f0:eb:cb:f1:a3:68:cf:e1:eb:7f:
-        a2:6d:1f:52:19:46:de:f1:8c:d0:1d:52:2b:a7:f0:70:2a:2f:
-        e6:7e:48:4b:2a:3f:68:4d:4d:c7:39:2a:bd:65:84:67:d1:73:
-        cd:a2:6f:38:59:29:2b:e4:71:ad:59:10:ff:ae:b2:c9:89:e1:
-        32:6e:87:6c:e2:6d:8c:24:d1:64:a8:19:3c:68:ee:b5:f2:f2:
-        5b:6c:36:0e:0f:85:3f:e6:9e:a1:6e:6e:2b:98:b4:94:3f:16:
-        a2:37:7b:45:bc:8f:b1:bc:e5:26:2b:dd:0d:55:34:1d:ee:7c:
-        70:a9
+        68:9e:f9:b9:92:e1:89:22:3f:c0:f0:e6:c5:61:f5:c5:c6:8a:
+        01:12:fb:d4:1c:86:1a:33:fa:6d:9f:a1:55:76:6b:1f:bb:13:
+        36:0d:94:20:c6:92:38:1e:5a:4d:e2:a9:60:76:b3:2b:24:c5:
+        fc:a7:f3:32:22:14:d6:e3:cd:0b:55:40:92:15:a7:f2:09:35:
+        02:e1:4e:b5:54:5a:41:54:cc:78:82:f3:d7:97:24:16:b0:b9:
+        00:35:a2:55:da:f2:ce:05:d3:46:f9:20:fa:35:9b:aa:12:3e:
+        ec:a8:d0:f6:40:6b:0e:5c:de:85:5f:b1:5e:5f:9f:f2:47:ec:
+        d4:b9
 -----BEGIN CERTIFICATE-----
 MIIChzCCAfCgAwIBAgIBCTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gxX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gx
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHoxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHoxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRUwEwYDVQQDFAxjaDIuMl9wdWJDQTExGzAZBgkqhkiG
 9w0BCQEWDGNoMi4yX3B1YkNBMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
-uE/YRjjPTfhoZBBKL4ss1l+JMkSQiSV2/1RlWdJ1htCUzy3wlBgjMv3O9Gugxw75
-qhj5C/7nhar/iuEEU/mkNHVFB2/xgAbKww87tEWX/gn1FxhsBek0aLneYaOs4SIP
-aXJvqahky4mjPTICJWRfSR4PUEcU8gq/jHJXRPkunmkCAwEAAaMhMB8wDwYDVR0T
-AQH/BAUwAwEB/zAMBgNVHRIBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAJypvtr3
-33GD8OvL8aNoz+Hrf6JtH1IZRt7xjNAdUiun8HAqL+Z+SEsqP2hNTcc5Kr1lhGfR
-c82ibzhZKSvkca1ZEP+ussmJ4TJuh2zibYwk0WSoGTxo7rXy8ltsNg4PhT/mnqFu
-biuYtJQ/FqI3e0W8j7G85SYr3Q1VNB3ufHCp
+yDMLsSpBQoxwiGDNUg6sQ9VlnUopTeYynaeuDt0MaD69C1F3U33IHUmiGSOVQbSb
+H4n7IZz4K+Nlwxciy8b2tM2Srqax9EF4ng1MSzY5pI2pKhEeCBqD9j02q9LHSOfH
+fVNUaqAFyl6NuX/rkWQ47DIPaWYVUmotvV8YcZnUHh0CAwEAAaMhMB8wDwYDVR0T
+AQH/BAUwAwEB/zAMBgNVHRIBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAGie+bmS
+4YkiP8Dw5sVh9cXGigES+9Qchhoz+m2foVV2ax+7EzYNlCDGkjgeWk3iqWB2sysk
+xfyn8zIiFNbjzQtVQJIVp/IJNQLhTrVUWkFUzHiC89eXJBawuQA1olXa8s4F00b5
+IPo1m6oSPuyo0PZAaw5c3oVfsV5fn/JH7NS5
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/chain_certs/ch1_pubCA1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/chain_certs/ch1_pubCA1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,59 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta1/emailAddress=pubCA1_ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch1_pubCA1/emailAddress=ch1_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:df:49:4c:8c:dd:25:e1:4d:81:08:01:65:e4:37:
-                    db:d4:87:be:f1:ca:f3:c2:e5:82:b0:d2:c9:09:a4:
-                    3d:41:2a:c9:40:c5:55:aa:0b:8f:41:42:82:3c:2e:
-                    47:23:23:88:e5:55:7e:3f:71:ae:c9:f9:d8:bf:b9:
-                    e0:4b:74:6d:82:af:20:f0:8c:03:4b:fb:d9:40:99:
-                    bf:94:90:f9:00:36:be:a7:97:0d:af:6f:e3:e6:43:
-                    0c:22:a7:2b:92:dd:24:8f:78:2e:dd:5a:6d:05:77:
-                    b6:16:d1:8a:07:4f:a1:af:71:c3:7a:b4:d3:54:2e:
-                    f5:9a:d3:b1:40:7f:e0:35:71
+                    00:d8:64:e4:d7:2c:48:51:df:1e:a5:e3:ba:8e:d9:
+                    11:9e:05:43:4c:17:20:37:93:c9:95:40:08:50:c7:
+                    ed:a7:20:8f:51:fe:45:b6:d5:e6:5b:f5:30:bb:95:
+                    95:2e:c9:cc:3d:b6:7d:07:55:7a:ec:36:4b:92:c8:
+                    cd:97:b4:0e:72:43:22:dd:3b:bc:1f:7e:9a:de:5d:
+                    97:3f:cb:48:08:c8:20:64:59:d9:db:88:3a:3c:3d:
+                    6d:1f:57:42:c0:17:b3:67:1d:3c:1b:1a:53:02:0d:
+                    8c:af:91:89:7b:4c:13:49:77:5d:c1:56:80:2b:a2:
+                    5c:79:c7:c6:c1:61:95:4a:35
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                D1:05:EC:55:23:1D:1E:53:EC:AE:71:88:8C:12:C2:AE:14:FE:12:5E
+                C6:B5:AB:18:BB:95:31:CE:CA:76:FC:4A:0E:4A:67:25:0D:6A:2B:8B
             X509v3 Authority Key Identifier: 
-                keyid:E8:81:62:06:D5:A6:C6:2E:6C:2A:4F:A3:21:42:59:CD:19:5B:32:ED
+                keyid:F1:31:DD:AE:13:EF:6C:62:A3:83:98:4D:1F:0D:25:1A:21:28:1E:5D
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i2_ta1/emailAddress=i2_ta1
                 serial:03
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        75:00:7d:53:6d:fb:70:10:81:5c:71:2e:c9:17:29:7b:fb:b8:
-        b0:97:c4:49:79:44:9e:ab:50:b5:65:aa:fe:99:18:2d:29:af:
-        8d:72:77:72:aa:ca:a5:1e:47:a9:a1:8d:a2:f5:10:ec:d5:a4:
-        95:d9:e0:1f:37:94:c3:e5:c5:75:17:d5:00:55:a5:d9:7c:38:
-        c2:07:18:b3:f3:48:33:15:7c:25:2d:61:16:71:a1:dc:7f:82:
-        85:c0:af:62:48:cf:ca:29:69:23:c5:cc:9e:dd:fa:40:3f:b9:
-        b5:1c:82:41:fa:53:50:f9:03:eb:42:de:a5:b4:bd:78:01:dc:
-        86:9b
+        6b:c1:e0:d3:b6:d9:9f:b5:a4:fd:37:99:77:76:4a:55:ee:4e:
+        e6:90:6e:98:77:87:56:cc:6f:a8:4d:2b:11:06:e6:bf:66:9d:
+        8f:21:b7:06:bd:1d:1f:df:12:49:41:84:86:ff:e0:19:6a:f0:
+        29:28:dd:d4:45:bd:19:af:f6:67:32:20:1d:af:fa:d4:f8:6e:
+        00:cd:32:c4:ca:62:f9:89:b1:85:21:a6:5c:cc:11:60:b4:50:
+        3b:40:fb:cd:d2:eb:72:f7:f1:26:94:4d:a6:5a:81:e9:67:d2:
+        0c:7d:d6:7f:ee:8a:83:a9:7c:9e:65:b2:c6:67:ef:ef:2b:a6:
+        2d:a6
 -----BEGIN CERTIFICATE-----
-MIIDMTCCApqgAwIBAgIBBDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIIDQTCCAqqgAwIBAgIBBDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMTEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMTAeFw0xMDA4MDQyMDU5MjNaFw0xMzA0MzAyMDU5MjNaMHYxCzAJBgNV
+Q0ExX3RhMTAeFw0xMTAxMjgwMjU0MTBaFw0xMzEwMjQwMjU0MTBaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjaDFfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjaDFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfSUyM
-3SXhTYEIAWXkN9vUh77xyvPC5YKw0skJpD1BKslAxVWqC49BQoI8LkcjI4jlVX4/
-ca7J+di/ueBLdG2CryDwjANL+9lAmb+UkPkANr6nlw2vb+PmQwwipyuS3SSPeC7d
-Wm0Fd7YW0YoHT6GvccN6tNNULvWa07FAf+A1cQIDAQABo4HOMIHLMB0GA1UdDgQW
-BBTRBexVIx0eU+yucYiMEsKuFP4SXjCBmAYDVR0jBIGQMIGNgBTogWIG1abGLmwq
-T6MhQlnNGVsy7aFypHAwbjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
+AQkBFgpjaDFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDYZOTX
+LEhR3x6l47qO2RGeBUNMFyA3k8mVQAhQx+2nII9R/kW21eZb9TC7lZUuycw9tn0H
+VXrsNkuSyM2XtA5yQyLdO7wffpreXZc/y0gIyCBkWdnbiDo8PW0fV0LAF7NnHTwb
+GlMCDYyvkYl7TBNJd13BVoArolx5x8bBYZVKNQIDAQABo4HeMIHbMB0GA1UdDgQW
+BBTGtasYu5Uxzsp2/EoOSmclDWorizCBmAYDVR0jBIGQMIGNgBTxMd2uE+9sYqOD
+mE0fDSUaISgeXaFypHAwbjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
 aWExEzARBgNVBAcTCk1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDzANBgNVBAMU
 BmkyX3RhMTEVMBMGCSqGSIb3DQEJARYGaTJfdGExggEDMA8GA1UdEwEB/wQFMAMB
-Af8wDQYJKoZIhvcNAQELBQADgYEAdQB9U237cBCBXHEuyRcpe/u4sJfESXlEnqtQ
-tWWq/pkYLSmvjXJ3cqrKpR5HqaGNovUQ7NWkldngHzeUw+XFdRfVAFWl2Xw4wgcY
-s/NIMxV8JS1hFnGh3H+ChcCvYkjPyilpI8XMnt36QD+5tRyCQfpTUPkD60LepbS9
-eAHchps=
+Af8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAGvB4NO22Z+1pP03
+mXd2SlXuTuaQbph3h1bMb6hNKxEG5r9mnY8htwa9HR/fEklBhIb/4Blq8Cko3dRF
+vRmv9mcyIB2v+tT4bgDNMsTKYvmJsYUhplzMEWC0UDtA+83S63L38SaUTaZageln
+0gx91n/uioOpfJ5lssZn7+8rpi2m
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/chain_certs/ch2.2_pubCA1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/chain_certs/ch2.2_pubCA1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch1_pubCA1/emailAddress=ch1_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2.2_pubCA1/emailAddress=ch2.2_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b8:4f:d8:46:38:cf:4d:f8:68:64:10:4a:2f:8b:
-                    2c:d6:5f:89:32:44:90:89:25:76:ff:54:65:59:d2:
-                    75:86:d0:94:cf:2d:f0:94:18:23:32:fd:ce:f4:6b:
-                    a0:c7:0e:f9:aa:18:f9:0b:fe:e7:85:aa:ff:8a:e1:
-                    04:53:f9:a4:34:75:45:07:6f:f1:80:06:ca:c3:0f:
-                    3b:b4:45:97:fe:09:f5:17:18:6c:05:e9:34:68:b9:
-                    de:61:a3:ac:e1:22:0f:69:72:6f:a9:a8:64:cb:89:
-                    a3:3d:32:02:25:64:5f:49:1e:0f:50:47:14:f2:0a:
-                    bf:8c:72:57:44:f9:2e:9e:69
+                    00:c8:33:0b:b1:2a:41:42:8c:70:88:60:cd:52:0e:
+                    ac:43:d5:65:9d:4a:29:4d:e6:32:9d:a7:ae:0e:dd:
+                    0c:68:3e:bd:0b:51:77:53:7d:c8:1d:49:a2:19:23:
+                    95:41:b4:9b:1f:89:fb:21:9c:f8:2b:e3:65:c3:17:
+                    22:cb:c6:f6:b4:cd:92:ae:a6:b1:f4:41:78:9e:0d:
+                    4c:4b:36:39:a4:8d:a9:2a:11:1e:08:1a:83:f6:3d:
+                    36:ab:d2:c7:48:e7:c7:7d:53:54:6a:a0:05:ca:5e:
+                    8d:b9:7f:eb:91:64:38:ec:32:0f:69:66:15:52:6a:
+                    2d:bd:5f:18:71:99:d4:1e:1d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,27 +29,27 @@
                 <EMPTY>
 
     Signature Algorithm: sha256WithRSAEncryption
-        9c:a9:be:da:f7:df:71:83:f0:eb:cb:f1:a3:68:cf:e1:eb:7f:
-        a2:6d:1f:52:19:46:de:f1:8c:d0:1d:52:2b:a7:f0:70:2a:2f:
-        e6:7e:48:4b:2a:3f:68:4d:4d:c7:39:2a:bd:65:84:67:d1:73:
-        cd:a2:6f:38:59:29:2b:e4:71:ad:59:10:ff:ae:b2:c9:89:e1:
-        32:6e:87:6c:e2:6d:8c:24:d1:64:a8:19:3c:68:ee:b5:f2:f2:
-        5b:6c:36:0e:0f:85:3f:e6:9e:a1:6e:6e:2b:98:b4:94:3f:16:
-        a2:37:7b:45:bc:8f:b1:bc:e5:26:2b:dd:0d:55:34:1d:ee:7c:
-        70:a9
+        68:9e:f9:b9:92:e1:89:22:3f:c0:f0:e6:c5:61:f5:c5:c6:8a:
+        01:12:fb:d4:1c:86:1a:33:fa:6d:9f:a1:55:76:6b:1f:bb:13:
+        36:0d:94:20:c6:92:38:1e:5a:4d:e2:a9:60:76:b3:2b:24:c5:
+        fc:a7:f3:32:22:14:d6:e3:cd:0b:55:40:92:15:a7:f2:09:35:
+        02:e1:4e:b5:54:5a:41:54:cc:78:82:f3:d7:97:24:16:b0:b9:
+        00:35:a2:55:da:f2:ce:05:d3:46:f9:20:fa:35:9b:aa:12:3e:
+        ec:a8:d0:f6:40:6b:0e:5c:de:85:5f:b1:5e:5f:9f:f2:47:ec:
+        d4:b9
 -----BEGIN CERTIFICATE-----
 MIIChzCCAfCgAwIBAgIBCTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gxX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gx
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHoxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHoxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRUwEwYDVQQDFAxjaDIuMl9wdWJDQTExGzAZBgkqhkiG
 9w0BCQEWDGNoMi4yX3B1YkNBMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
-uE/YRjjPTfhoZBBKL4ss1l+JMkSQiSV2/1RlWdJ1htCUzy3wlBgjMv3O9Gugxw75
-qhj5C/7nhar/iuEEU/mkNHVFB2/xgAbKww87tEWX/gn1FxhsBek0aLneYaOs4SIP
-aXJvqahky4mjPTICJWRfSR4PUEcU8gq/jHJXRPkunmkCAwEAAaMhMB8wDwYDVR0T
-AQH/BAUwAwEB/zAMBgNVHRIBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAJypvtr3
-33GD8OvL8aNoz+Hrf6JtH1IZRt7xjNAdUiun8HAqL+Z+SEsqP2hNTcc5Kr1lhGfR
-c82ibzhZKSvkca1ZEP+ussmJ4TJuh2zibYwk0WSoGTxo7rXy8ltsNg4PhT/mnqFu
-biuYtJQ/FqI3e0W8j7G85SYr3Q1VNB3ufHCp
+yDMLsSpBQoxwiGDNUg6sQ9VlnUopTeYynaeuDt0MaD69C1F3U33IHUmiGSOVQbSb
+H4n7IZz4K+Nlwxciy8b2tM2Srqax9EF4ng1MSzY5pI2pKhEeCBqD9j02q9LHSOfH
+fVNUaqAFyl6NuX/rkWQ47DIPaWYVUmotvV8YcZnUHh0CAwEAAaMhMB8wDwYDVR0T
+AQH/BAUwAwEB/zAMBgNVHRIBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAGie+bmS
+4YkiP8Dw5sVh9cXGigES+9Qchhoz+m2foVV2ax+7EzYNlCDGkjgeWk3iqWB2sysk
+xfyn8zIiFNbjzQtVQJIVp/IJNQLhTrVUWkFUzHiC89eXJBawuQA1olXa8s4F00b5
+IPo1m6oSPuyo0PZAaw5c3oVfsV5fn/JH7NS5
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/chain_certs/ch2_pubCA1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/chain_certs/ch2_pubCA1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,59 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch1_pubCA1/emailAddress=ch1_pubCA1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b1:17:94:03:99:12:09:1e:f2:3f:76:e3:63:11:
-                    75:3c:41:46:ca:3f:2c:9d:2f:e3:2f:39:90:63:a1:
-                    d0:31:e1:b7:eb:94:f3:c5:7c:2b:4a:da:9b:d2:28:
-                    29:68:72:4e:c8:53:0c:84:9b:6b:a1:7d:63:49:3b:
-                    65:e6:be:11:a5:ba:41:5e:74:0d:16:ae:95:26:02:
-                    79:ca:38:df:13:e9:f7:97:52:cd:d3:85:49:ec:cf:
-                    75:cd:54:13:f0:15:0d:65:ee:ea:e5:7b:3b:63:3e:
-                    5f:a9:4b:56:d3:10:1d:9b:47:ed:2f:46:54:53:19:
-                    b0:2e:63:cd:12:f4:40:4a:6b
+                    00:ec:10:82:b8:bd:a9:12:9e:70:2e:52:89:62:d7:
+                    8d:9c:a4:01:07:27:ee:20:92:6e:07:1e:dd:58:98:
+                    5b:65:6f:85:1b:b0:cd:e7:6d:f6:b3:9b:bd:1f:be:
+                    93:09:79:b6:f8:0a:45:8c:c4:b8:22:a3:fb:ad:96:
+                    03:6b:0f:18:b6:fa:d3:b5:35:99:92:a3:82:a2:71:
+                    93:ba:76:e4:ba:f6:87:2f:e8:a2:ed:2b:0c:a7:e4:
+                    bf:ae:9c:03:08:8a:1e:29:25:66:72:14:f1:99:05:
+                    2c:29:14:4d:59:b8:71:d6:95:78:48:7d:a3:b9:8f:
+                    eb:9e:e9:7c:b8:5c:65:5b:e7
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                3D:8C:8F:DF:07:E7:F3:5E:C1:50:68:37:8B:8A:DB:BD:15:5B:4C:2E
+                A2:7C:37:64:6C:9B:F6:34:69:35:2F:6E:2A:03:57:1C:DD:C7:69:60
             X509v3 Authority Key Identifier: 
-                keyid:D1:05:EC:55:23:1D:1E:53:EC:AE:71:88:8C:12:C2:AE:14:FE:12:5E
+                keyid:C6:B5:AB:18:BB:95:31:CE:CA:76:FC:4A:0E:4A:67:25:0D:6A:2B:8B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta1/emailAddress=pubCA1_ta1
                 serial:04
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        aa:60:e0:f8:bb:6d:07:de:5a:d1:58:07:27:64:29:68:49:2b:
-        42:67:25:da:c0:dc:52:82:98:b8:1b:79:a9:65:2a:fe:c7:78:
-        46:ca:76:1a:fe:b0:b1:9f:2f:d3:4c:4b:02:65:39:57:2a:a1:
-        48:ba:6b:9d:f7:67:80:70:8f:38:00:0f:4e:b2:57:ac:59:ad:
-        97:b7:46:67:39:3d:75:12:ff:8f:ac:d9:65:0f:a7:05:a5:1e:
-        49:94:a5:a1:44:4f:e7:ba:b9:af:5d:2c:3d:29:cd:a2:e2:c5:
-        2c:ac:1f:1e:7f:64:bf:97:d4:a9:6c:d1:91:9c:50:20:af:50:
-        ad:6b
+        8f:da:b0:83:87:60:1c:12:43:c5:37:e3:09:36:f2:5b:b2:e8:
+        36:eb:d5:c6:00:30:22:8c:e0:33:6a:61:8b:1b:45:d3:b4:e3:
+        c0:05:54:ef:52:1e:d1:41:f5:7d:c2:3b:0d:24:d5:78:bf:f1:
+        93:ad:32:c5:66:8c:3b:84:0d:f7:0b:e4:08:2c:bf:10:47:09:
+        02:18:d4:19:40:f1:18:af:c1:38:90:89:b1:a2:48:d2:b1:4d:
+        f9:ad:86:f2:64:cc:35:fb:35:87:25:49:2b:e3:29:23:f3:fd:
+        47:55:4c:2d:05:c3:c4:5b:75:27:4a:45:2a:e2:7f:5b:c5:b8:
+        97:78
 -----BEGIN CERTIFICATE-----
-MIIDOTCCAqKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIIDSTCCArKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gxX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gx
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjNaFw0xMzA0MzAyMDU5MjNaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTBaFw0xMzEwMjQwMjU0MTBaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjaDJfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjaDJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxF5QD
-mRIJHvI/duNjEXU8QUbKPyydL+MvOZBjodAx4bfrlPPFfCtK2pvSKClock7IUwyE
-m2uhfWNJO2XmvhGlukFedA0WrpUmAnnKON8T6feXUs3ThUnsz3XNVBPwFQ1l7url
-eztjPl+pS1bTEB2bR+0vRlRTGbAuY80S9EBKawIDAQABo4HWMIHTMB0GA1UdDgQW
-BBQ9jI/fB+fzXsFQaDeLitu9FVtMLjCBoAYDVR0jBIGYMIGVgBTRBexVIx0eU+yu
-cYiMEsKuFP4SXqF6pHgwdjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
+AQkBFgpjaDJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDsEIK4
+vakSnnAuUoli142cpAEHJ+4gkm4HHt1YmFtlb4UbsM3nbfazm70fvpMJebb4CkWM
+xLgio/utlgNrDxi2+tO1NZmSo4KicZO6duS69ocv6KLtKwyn5L+unAMIih4pJWZy
+FPGZBSwpFE1ZuHHWlXhIfaO5j+ue6Xy4XGVb5wIDAQABo4HmMIHjMB0GA1UdDgQW
+BBSifDdkbJv2NGk1L24qA1cc3cdpYDCBoAYDVR0jBIGYMIGVgBTGtasYu5Uxzsp2
+/EoOSmclDWori6F6pHgwdjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3Ju
 aWExEzARBgNVBAcTCk1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxEzARBgNVBAMU
 CnB1YkNBMV90YTExGTAXBgkqhkiG9w0BCQEWCnB1YkNBMV90YTGCAQQwDwYDVR0T
-AQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQCqYOD4u20H3lrRWAcnZCloSStC
-ZyXawNxSgpi4G3mpZSr+x3hGynYa/rCxny/TTEsCZTlXKqFIumud92eAcI84AA9O
-slesWa2Xt0ZnOT11Ev+PrNllD6cFpR5JlKWhRE/nurmvXSw9Kc2i4sUsrB8ef2S/
-l9SpbNGRnFAgr1Ctaw==
+AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAj9qw
+g4dgHBJDxTfjCTbyW7LoNuvVxgAwIozgM2phixtF07TjwAVU71Ie0UH1fcI7DSTV
+eL/xk60yxWaMO4QN9wvkCCy/EEcJAhjUGUDxGK/BOJCJsaJI0rFN+a2G8mTMNfs1
+hyVJK+MpI/P9R1VMLQXDxFt1J0pFKuJ/W8W4l3g=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/06.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/06.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,50 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_pubCA1/emailAddress=cs1_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:97:a7:b6:9a:40:63:12:2f:3c:4b:3f:75:d2:53:
-                    5b:c9:c9:6e:7c:fc:f6:8e:35:7f:7a:5a:b2:fa:00:
-                    eb:dd:f0:f2:87:2a:c9:9b:4d:7e:2d:3c:f1:0e:4e:
-                    ff:b4:b1:91:88:2f:c3:ab:ae:65:39:1e:da:e8:7e:
-                    50:b5:94:48:a6:5c:b0:bb:42:aa:70:e6:50:9c:41:
-                    2c:67:38:6c:e0:5d:9a:7d:b4:95:36:54:ea:e8:48:
-                    24:31:1c:30:39:24:2c:2a:1f:de:c2:c8:bf:e8:82:
-                    35:4a:9b:52:8e:15:e8:34:df:0c:78:be:e5:c6:85:
-                    c6:79:88:75:c0:04:e4:b8:77
+                    00:d6:e0:78:fd:9b:ec:79:f0:02:f0:cc:7a:8b:63:
+                    e1:60:e3:41:a8:d8:0d:82:4a:2d:ee:6c:53:b0:6b:
+                    21:50:42:06:2e:a6:af:3d:fa:e8:55:a0:79:54:31:
+                    cb:65:f8:03:e6:84:a9:3d:76:cc:7b:06:de:d3:25:
+                    0e:e5:e3:99:18:7c:13:9e:73:3d:5c:88:7a:5d:f5:
+                    58:54:08:cf:bf:fc:73:d0:ef:be:f5:04:fb:71:4b:
+                    98:84:82:3a:61:f5:04:29:48:5d:3d:c2:73:56:33:
+                    8e:0e:fc:0d:3a:1e:57:d9:a3:7c:c9:fd:db:27:8a:
+                    1a:de:d4:13:53:ce:a2:12:79
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        61:86:7f:54:cd:2f:e0:7f:2a:9a:20:55:23:af:00:79:13:25:
-        2e:29:4e:c6:40:d5:66:60:ea:34:b8:9a:cc:d9:39:04:63:d7:
-        f8:ae:a3:3d:73:54:34:8d:67:5a:92:b1:1a:f8:f0:38:f3:64:
-        2e:45:32:bd:29:a1:e3:32:d6:c7:73:77:70:c0:f0:e6:d4:00:
-        62:3b:e2:23:12:bb:f4:f7:d7:0c:15:74:2a:b0:cb:90:00:f3:
-        ba:ad:3c:15:35:4b:ef:c3:08:34:4e:02:e7:6c:bd:2c:e6:45:
-        43:fa:c5:1d:14:3c:6b:33:01:1d:22:b2:12:2e:0e:e7:82:53:
-        49:9b
+        e1:3a:ec:60:96:47:14:c0:7a:76:85:f9:54:21:ae:48:b9:d1:
+        33:a3:62:73:07:04:83:aa:4b:a7:6a:3f:a9:ff:8e:34:8c:38:
+        c0:a4:38:c2:66:75:6f:67:20:31:1d:9b:bf:a7:19:52:c5:56:
+        ff:5c:f1:a8:07:bc:66:7f:e0:49:23:18:af:fa:ca:c7:36:0b:
+        67:85:08:d3:35:61:44:ce:6b:d5:f2:92:a5:bc:98:d1:24:68:
+        3c:a9:0a:f7:71:a4:0b:41:fb:69:37:7c:78:d4:4b:18:ab:2b:
+        95:a9:19:cb:b7:01:53:65:cc:d4:22:a1:69:47:bd:e8:db:41:
+        fe:82
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBBjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBBjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gyX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gy
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXp7aa
-QGMSLzxLP3XSU1vJyW58/PaONX96WrL6AOvd8PKHKsmbTX4tPPEOTv+0sZGIL8Or
-rmU5HtroflC1lEimXLC7Qqpw5lCcQSxnOGzgXZp9tJU2VOroSCQxHDA5JCwqH97C
-yL/ogjVKm1KOFeg03wx4vuXGhcZ5iHXABOS4dwIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBhhn9UzS/gfyqaIFUj
-rwB5EyUuKU7GQNVmYOo0uJrM2TkEY9f4rqM9c1Q0jWdakrEa+PA482QuRTK9KaHj
-MtbHc3dwwPDm1ABiO+IjErv099cMFXQqsMuQAPO6rTwVNUvvwwg0TgLnbL0s5kVD
-+sUdFDxrMwEdIrISLg7nglNJmw==
+AQkBFgpjczFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDW4Hj9
+m+x58ALwzHqLY+Fg40Go2A2CSi3ubFOwayFQQgYupq89+uhVoHlUMctl+APmhKk9
+dsx7Bt7TJQ7l45kYfBOecz1ciHpd9VhUCM+//HPQ7771BPtxS5iEgjph9QQpSF09
+wnNWM44O/A06HlfZo3zJ/dsnihre1BNTzqISeQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQDhOuxglkcUwHp2
+hflUIa5IudEzo2JzBwSDqkunaj+p/440jDjApDjCZnVvZyAxHZu/pxlSxVb/XPGo
+B7xmf+BJIxiv+srHNgtnhQjTNWFEzmvV8pKlvJjRJGg8qQr3caQLQftpN3x41EsY
+qyuVqRnLtwFTZczUIqFpR73o20H+gg==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/07.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/07.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs2_pubCA1/emailAddress=cs2_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:bc:d4:1e:7a:76:36:24:10:2f:84:b3:ed:24:8f:
-                    0b:85:8a:17:39:2f:15:26:0a:80:e2:60:aa:c0:00:
-                    af:d5:ba:9c:ef:b0:3a:09:31:e7:97:37:82:ea:32:
-                    a0:c5:75:c3:0e:0f:6a:77:ef:66:77:2f:6a:a2:60:
-                    5b:b7:86:39:df:12:94:4e:61:79:de:dd:d2:fc:d1:
-                    a0:ba:fe:6a:24:09:3b:4f:1e:35:19:e2:15:25:8b:
-                    7c:03:19:66:3d:10:45:91:9c:83:9a:71:c9:b2:eb:
-                    df:a9:64:c7:2d:5a:93:23:d3:5d:ec:64:03:64:f4:
-                    34:b9:ee:40:1d:df:0c:c5:3d
+                    00:d1:1e:d4:1f:8e:07:3a:4f:d3:23:c7:80:1a:ea:
+                    17:87:6b:38:d4:f8:1c:9b:1d:22:de:41:47:d0:dd:
+                    65:9f:63:92:a1:a0:a4:58:22:53:dd:68:bd:86:a8:
+                    88:a3:a9:64:15:fb:b2:75:6a:bb:cd:f0:d8:11:40:
+                    80:ce:2a:55:8f:15:d4:86:f9:2a:47:81:e1:1f:89:
+                    02:4d:ce:7f:9a:34:b3:87:08:d3:fd:1f:db:02:09:
+                    9c:c6:e6:83:f6:79:78:97:cc:aa:e8:47:0b:d2:f7:
+                    9d:55:31:50:e4:ae:d6:24:b2:f5:57:bf:0e:76:ae:
+                    f7:9c:c0:04:66:b0:3e:7c:4f
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,28 +29,28 @@
                 URI:http://localhost:12001/file/0/pubCA1_ta1_crl.pem
 
     Signature Algorithm: sha256WithRSAEncryption
-        39:29:a1:18:73:e2:98:bd:03:ed:99:eb:dc:f3:a3:da:cb:3e:
-        b3:5e:4c:f5:27:2f:c0:9d:7b:d1:3b:97:dc:cc:00:ca:f3:81:
-        48:65:d5:a8:07:42:25:8e:9e:66:38:eb:ca:68:f3:f0:15:95:
-        21:7b:c9:ec:9b:b1:af:dc:63:95:a2:cd:8c:dc:88:f5:7d:37:
-        2f:20:02:ea:b9:c5:e3:64:c2:4a:2d:94:54:10:4e:b9:07:8a:
-        46:99:7c:26:40:82:e5:65:30:df:66:02:6c:17:d8:6e:95:d4:
-        ff:09:25:15:0b:68:7b:ab:84:35:c9:3f:ec:3f:92:76:f2:59:
-        c2:50
+        89:bf:be:5d:02:b5:ce:54:5d:07:30:23:a2:bf:4d:9f:28:97:
+        e1:71:2a:fa:28:42:9e:21:db:7f:e2:58:9e:a2:09:37:6c:85:
+        cc:02:8b:fc:8b:d7:f1:d3:86:93:64:7e:bd:4c:6f:1d:90:30:
+        b4:b0:f7:57:81:0a:f1:1d:1d:9c:8b:a4:da:1b:9a:ff:0f:4b:
+        e4:75:04:10:b1:a8:65:3a:08:2e:02:ae:eb:c6:8f:c0:d9:9c:
+        40:df:0d:58:a6:3f:11:bd:68:a5:2c:58:b9:02:b2:21:d4:e3:
+        c8:da:68:52:fd:26:31:34:8a:19:8d:e0:87:c7:23:46:40:92:
+        ba:31
 -----BEGIN CERTIFICATE-----
 MIICtTCCAh6gAwIBAgIBBzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gyX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gy
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczJfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjczJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC81B56
-djYkEC+Es+0kjwuFihc5LxUmCoDiYKrAAK/VupzvsDoJMeeXN4LqMqDFdcMOD2p3
-72Z3L2qiYFu3hjnfEpROYXne3dL80aC6/mokCTtPHjUZ4hUli3wDGWY9EEWRnIOa
-ccmy69+pZMctWpMj013sZANk9DS57kAd3wzFPQIDAQABo1MwUTAMBgNVHRMBAf8E
+AQkBFgpjczJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRHtQf
+jgc6T9Mjx4Aa6heHazjU+BybHSLeQUfQ3WWfY5KhoKRYIlPdaL2GqIijqWQV+7J1
+arvN8NgRQIDOKlWPFdSG+SpHgeEfiQJNzn+aNLOHCNP9H9sCCZzG5oP2eXiXzKro
+RwvS951VMVDkrtYksvVXvw52rvecwARmsD58TwIDAQABo1MwUTAMBgNVHRMBAf8E
 AjAAMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmls
-ZS8wL3B1YkNBMV90YTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQA5KaEYc+KY
-vQPtmevc86Payz6zXkz1Jy/AnXvRO5fczADK84FIZdWoB0Iljp5mOOvKaPPwFZUh
-e8nsm7Gv3GOVos2M3Ij1fTcvIALqucXjZMJKLZRUEE65B4pGmXwmQILlZTDfZgJs
-F9huldT/CSUVC2h7q4Q1yT/sP5J28lnCUA==
+ZS8wL3B1YkNBMV90YTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQCJv75dArXO
+VF0HMCOiv02fKJfhcSr6KEKeIdt/4lieogk3bIXMAov8i9fx04aTZH69TG8dkDC0
+sPdXgQrxHR2ci6TaG5r/D0vkdQQQsahlOgguAq7rxo/A2ZxA3w1Ypj8RvWilLFi5
+ArIh1OPI2mhS/SYxNIoZjeCHxyNGQJK6MQ==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/08.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/08.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs3_pubCA1/emailAddress=cs3_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:ae:1e:e7:bd:54:fe:74:88:e0:34:0d:32:b2:1b:
-                    ea:3e:63:fd:7b:1b:13:cc:84:29:e1:f8:7d:c4:9c:
-                    65:aa:3a:2b:fd:c9:7c:03:57:03:b2:12:75:b9:c9:
-                    5e:02:a4:8e:6d:c7:54:c1:cd:e1:30:28:5f:a8:64:
-                    c9:c2:02:e2:3b:af:5e:b3:ec:2c:1c:5c:48:50:07:
-                    87:e4:19:80:ef:b4:78:6f:f2:6f:dd:64:61:97:ce:
-                    a7:29:0a:07:3c:6f:2e:44:fe:38:70:5b:c6:44:bb:
-                    cf:f5:3f:b3:20:3b:3b:81:fa:77:25:ab:1f:4f:f6:
-                    db:28:fd:7f:ba:2f:57:18:47
+                    00:da:26:a1:68:66:ec:6f:7f:7c:94:94:0f:74:17:
+                    52:0e:41:86:ae:43:40:f1:ea:c0:af:e8:51:03:96:
+                    82:4e:35:d4:44:a0:0d:0d:67:2b:44:bf:81:5c:87:
+                    9a:62:42:59:0e:97:81:75:35:6e:18:67:7e:95:41:
+                    47:5c:51:f6:5a:27:dc:b9:2a:2a:ea:5b:6c:b9:59:
+                    78:7c:fb:ff:59:67:5d:35:8b:b7:90:71:29:68:80:
+                    c8:b0:ad:37:60:96:21:34:79:25:41:20:f8:40:e4:
+                    32:90:c0:16:81:c3:b3:47:9f:02:bb:15:7d:32:6d:
+                    5d:75:04:45:cf:23:b5:8e:95
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,28 +29,28 @@
                 URI:http://localhost:12001/file/0/ch1_pubCA1_crl.pem
 
     Signature Algorithm: sha256WithRSAEncryption
-        22:d6:f3:a1:9f:65:9a:2d:d1:3f:50:ea:ba:52:99:1e:1f:95:
-        38:e4:e0:cb:7e:fc:7f:5a:82:75:a4:fa:23:64:7b:4f:63:b1:
-        b5:30:34:38:8e:d1:54:13:a6:1e:7b:3b:f0:3e:94:54:1e:a4:
-        5c:19:3c:38:18:d7:ee:b0:31:ea:ac:d1:b2:18:4b:a7:19:93:
-        45:8f:a2:b6:cf:0b:39:73:b6:80:2e:3d:48:de:18:af:98:4e:
-        cc:15:a2:a4:98:a0:d1:03:36:05:b1:e7:81:94:3b:cd:da:b2:
-        fc:2b:ff:9f:e5:fe:9c:b8:2b:5c:1a:75:00:58:54:a3:f1:4e:
-        cf:53
+        dd:86:89:f4:bb:73:30:c8:1d:74:90:de:cc:b0:7b:a5:0c:30:
+        02:d1:b9:f1:65:c0:f7:2b:cb:60:3b:87:73:ad:dd:0c:fe:d7:
+        7f:93:8f:63:ce:fd:de:30:06:30:1d:b4:40:65:86:a8:19:da:
+        d6:ac:2f:bb:65:49:51:38:6b:44:fb:69:5e:03:e6:c3:80:86:
+        fd:46:4d:c1:4d:c9:7b:85:92:b9:9b:75:72:43:94:75:73:73:
+        06:45:33:3a:5b:16:d0:c3:26:58:39:9c:e6:bf:df:48:b8:72:
+        c3:8a:d3:10:cc:9c:c4:91:e9:85:b6:5e:5d:88:f0:94:df:20:
+        9f:33
 -----BEGIN CERTIFICATE-----
 MIICtTCCAh6gAwIBAgIBCDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gyX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gy
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczNfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjczNfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCuHue9
-VP50iOA0DTKyG+o+Y/17GxPMhCnh+H3EnGWqOiv9yXwDVwOyEnW5yV4CpI5tx1TB
-zeEwKF+oZMnCAuI7r16z7CwcXEhQB4fkGYDvtHhv8m/dZGGXzqcpCgc8by5E/jhw
-W8ZEu8/1P7MgOzuB+nclqx9P9tso/X+6L1cYRwIDAQABo1MwUTAMBgNVHRMBAf8E
+AQkBFgpjczNfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaJqFo
+Zuxvf3yUlA90F1IOQYauQ0Dx6sCv6FEDloJONdREoA0NZytEv4Fch5piQlkOl4F1
+NW4YZ36VQUdcUfZaJ9y5KirqW2y5WXh8+/9ZZ101i7eQcSlogMiwrTdgliE0eSVB
+IPhA5DKQwBaBw7NHnwK7FX0ybV11BEXPI7WOlQIDAQABo1MwUTAMBgNVHRMBAf8E
 AjAAMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmls
-ZS8wL2NoMV9wdWJDQTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQAi1vOhn2Wa
-LdE/UOq6UpkeH5U45ODLfvx/WoJ1pPojZHtPY7G1MDQ4jtFUE6YeezvwPpRUHqRc
-GTw4GNfusDHqrNGyGEunGZNFj6K2zws5c7aALj1I3hivmE7MFaKkmKDRAzYFseeB
-lDvN2rL8K/+f5f6cuCtcGnUAWFSj8U7PUw==
+ZS8wL2NoMV9wdWJDQTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQDdhon0u3Mw
+yB10kN7MsHulDDAC0bnxZcD3K8tgO4dzrd0M/td/k49jzv3eMAYwHbRAZYaoGdrW
+rC+7ZUlROGtE+2leA+bDgIb9Rk3BTcl7hZK5m3VyQ5R1c3MGRTM6WxbQwyZYOZzm
+v99IuHLDitMQzJzEkemFtl5diPCU3yCfMw==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/0A.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/0A.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,50 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2.2_pubCA1/emailAddress=ch2.2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:12 2011 GMT
+            Not After : Oct 24 02:54:12 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs4_pubCA1/emailAddress=cs4_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b7:e6:67:c1:7f:08:9e:27:00:00:ce:8e:e4:5b:
-                    f5:65:d0:f2:4e:ac:d4:07:b8:21:a2:5a:9b:bd:e3:
-                    48:24:ff:f1:ec:05:49:c2:34:5a:ca:f5:9b:91:2b:
-                    3c:6a:31:ea:3b:25:53:c9:09:3b:2b:24:32:8b:8c:
-                    4c:30:95:78:e9:7c:f0:d7:bc:f8:4e:24:8b:c5:dd:
-                    b4:50:5a:a8:68:78:15:ee:52:73:6e:5a:9a:f9:dd:
-                    7c:39:90:f1:ef:bf:e5:a5:18:dc:d4:d8:a1:8f:2e:
-                    6a:9c:17:dc:20:93:59:e6:c4:3d:bb:f2:a8:0e:ea:
-                    1a:be:a9:54:7f:a2:7b:48:73
+                    00:df:f2:c5:0d:12:9b:77:c9:0f:03:07:db:91:4e:
+                    6a:94:fd:50:fc:2b:78:ab:ad:40:eb:8d:d4:fa:42:
+                    99:5e:68:4a:1c:a7:ca:82:da:4b:22:b1:81:20:b7:
+                    df:e4:c6:df:3f:95:5a:fd:03:8e:47:fc:85:43:d4:
+                    b1:53:d1:cd:6b:eb:82:47:f6:21:35:71:fe:da:c1:
+                    2b:50:d7:61:ef:7e:60:d7:61:3e:64:3f:33:ab:0e:
+                    88:0f:41:3d:15:9e:f5:f1:4f:c3:90:d3:6e:16:32:
+                    5f:33:52:5c:2d:8a:43:dd:23:c5:4a:e7:85:42:29:
+                    03:ee:10:cd:a5:e1:02:73:63
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        6a:34:f8:4a:4b:80:50:1e:e8:bd:17:75:d4:c5:e5:30:b7:63:
-        2f:18:18:e8:24:38:ec:a3:e9:a9:39:f0:2c:4c:83:22:b6:ed:
-        38:9e:08:d4:3e:3d:b6:5e:2f:2d:cd:84:43:60:92:f0:1e:6c:
-        06:6a:86:f3:d9:bb:c7:1c:77:aa:21:b0:0d:34:c6:86:b2:7c:
-        cc:66:12:89:16:eb:39:a6:2f:2b:4b:0e:95:87:4f:28:e3:62:
-        73:c2:99:68:26:ee:5f:e4:64:99:d1:a7:b7:25:66:a8:19:f3:
-        36:c5:b8:1e:7e:ed:10:af:6e:38:a9:9a:03:55:3f:2f:4e:2a:
-        af:9a
+        96:2d:e6:30:36:53:f7:af:a6:40:75:9f:d6:55:7a:8d:71:31:
+        54:f8:61:6c:8e:45:fd:86:5f:1f:88:7c:df:d3:af:5c:1e:da:
+        2d:40:c3:00:b4:a8:05:2d:c2:7c:6e:a7:45:45:26:e9:1f:25:
+        25:9d:b6:2b:1f:7d:ba:79:63:7e:e8:73:2d:49:0e:a5:a3:02:
+        7b:d3:9a:ab:df:55:5e:4d:aa:8e:ae:10:0d:de:50:bd:0e:47:
+        d1:60:ff:4c:87:b7:f4:49:ee:68:3f:f4:a1:dd:b6:72:73:43:
+        fc:3e:b8:4a:f3:7c:6c:95:b3:cb:ba:78:aa:35:5c:b0:48:3e:
+        0d:90
 -----BEGIN CERTIFICATE-----
-MIICgzCCAeygAwIBAgIBCjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzET
+MIIChjCCAe+gAwIBAgIBCjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEVMBMGA1UEAxQMY2gyLjJfcHViQ0ExMRswGQYJKoZIhvcNAQkBFgxj
-aDIuMl9wdWJDQTEwHhcNMTAwODA0MjA1OTI1WhcNMTMwNDMwMjA1OTI1WjB2MQsw
+aDIuMl9wdWJDQTEwHhcNMTEwMTI4MDI1NDEyWhcNMTMxMDI0MDI1NDEyWjB2MQsw
 CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8g
 UGFyazENMAsGA1UEChMEcGtnNTETMBEGA1UEAxQKY3M0X3B1YkNBMTEZMBcGCSqG
 SIb3DQEJARYKY3M0X3B1YkNBMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
-t+ZnwX8InicAAM6O5Fv1ZdDyTqzUB7gholqbveNIJP/x7AVJwjRayvWbkSs8ajHq
-OyVTyQk7KyQyi4xMMJV46Xzw17z4TiSLxd20UFqoaHgV7lJzblqa+d18OZDx77/l
-pRjc1Nihjy5qnBfcIJNZ5sQ9u/KoDuoavqlUf6J7SHMCAwEAAaMdMBswDAYDVR0T
-AQH/BAIwADALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADgYEAajT4SkuAUB7o
-vRd11MXlMLdjLxgY6CQ47KPpqTnwLEyDIrbtOJ4I1D49tl4vLc2EQ2CS8B5sBmqG
-89m7xxx3qiGwDTTGhrJ8zGYSiRbrOaYvK0sOlYdPKONic8KZaCbuX+RkmdGntyVm
-qBnzNsW4Hn7tEK9uOKmaA1U/L04qr5o=
+3/LFDRKbd8kPAwfbkU5qlP1Q/Ct4q61A643U+kKZXmhKHKfKgtpLIrGBILff5Mbf
+P5Va/QOOR/yFQ9SxU9HNa+uCR/YhNXH+2sErUNdh735g12E+ZD8zqw6ID0E9FZ71
+8U/DkNNuFjJfM1JcLYpD3SPFSueFQikD7hDNpeECc2MCAwEAAaMgMB4wDAYDVR0T
+AQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADgYEAli3mMDZT
+96+mQHWf1lV6jXExVPhhbI5F/YZfH4h839OvXB7aLUDDALSoBS3CfG6nRUUm6R8l
+JZ22Kx99unljfuhzLUkOpaMCe9Oaq99VXk2qjq4QDd5QvQ5H0WD/TIe39EnuaD/0
+od22cnND/D64SvN8bJWzy7p4qjVcsEg+DZA=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/0B.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/0B.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,49 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta2/emailAddress=ta2
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta2/emailAddress=cs1_ta2
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b7:0f:a6:ed:f2:e7:d2:c1:de:09:a9:5b:7d:ba:
-                    41:14:76:aa:26:fc:f6:a5:0b:d5:42:a5:e1:f0:5b:
-                    2a:15:f0:60:b7:df:06:13:02:06:03:e3:df:31:b9:
-                    4f:60:1c:ed:04:55:28:11:bd:8b:7b:9d:98:6a:2c:
-                    18:e8:45:85:a5:8b:ce:4c:87:3e:91:46:dd:76:91:
-                    ca:d1:0d:36:02:1b:23:18:4c:44:01:a4:8e:30:01:
-                    fe:09:a8:46:28:e3:2e:e5:5f:45:66:f9:a5:81:2a:
-                    f3:97:0d:c8:ed:22:cf:59:82:4b:cc:c6:eb:14:35:
-                    48:48:df:a8:58:a4:3c:80:63
+                    00:b8:c1:19:42:b1:26:a9:33:1f:1f:55:d0:4f:6d:
+                    43:a3:55:75:c7:de:18:5a:69:cc:62:b2:a6:ec:f5:
+                    78:19:31:5a:1a:d8:6c:d8:48:66:7d:15:d4:da:fe:
+                    dd:7c:42:a0:ae:22:d1:51:f5:22:54:49:7d:16:58:
+                    cf:82:b7:3e:45:c5:7e:da:84:28:f6:b3:5c:90:61:
+                    27:0e:70:fe:fa:6c:3f:20:0a:a0:10:50:9c:75:a4:
+                    02:62:d8:68:26:63:ba:21:10:89:39:ab:18:fa:10:
+                    77:26:4f:ac:f1:50:41:fc:8c:f7:dc:e9:20:19:7c:
+                    2c:fb:02:c7:40:6d:69:ff:05
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        79:48:fb:8f:11:f5:8b:94:10:b2:09:f5:ee:de:34:e9:61:b7:
-        00:53:0b:82:99:dd:34:13:cf:de:73:54:12:af:62:24:a8:9b:
-        10:1e:04:f6:39:ac:10:20:80:70:d5:ee:29:40:00:91:ae:e5:
-        62:cf:1c:22:19:b2:bf:3a:b5:b1:b1:89:29:d7:c2:50:c6:5c:
-        1b:d8:e5:02:f1:c1:a9:f1:bc:b7:6c:37:65:2b:25:18:31:10:
-        56:73:b0:71:30:6e:2a:f5:82:31:81:75:81:05:0b:11:5e:ed:
-        28:85:0a:cc:17:1e:a0:c8:37:01:a6:75:71:9a:89:89:c9:24:
-        1e:5b
+        4b:b0:61:5b:c9:9a:81:8a:04:92:d4:98:39:fc:45:bd:34:90:
+        cc:69:4f:86:09:47:3f:e9:26:e2:a0:e6:d4:63:53:32:85:48:
+        de:1a:ef:43:bb:8d:19:29:5f:f8:13:bc:27:76:82:d2:77:6d:
+        80:68:e9:96:a3:cd:a3:d0:3c:b1:2a:94:54:7f:d9:95:61:07:
+        f7:d9:84:67:ea:bf:23:10:1a:9a:23:f7:3b:aa:83:a4:3c:18:
+        12:95:11:18:fb:2e:93:7c:84:61:6c:50:7d:67:ac:44:39:f5:
+        f2:9a:b0:89:f9:bd:71:e0:ae:bb:53:bc:ce:97:5e:ee:cd:14:
+        ad:14
 -----BEGIN CERTIFICATE-----
-MIICazCCAdSgAwIBAgIBCzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIICbjCCAdegAwIBAgIBCzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEyMRIwEAYJKoZIhvcNAQkBFgN0YTIwHhcNMTAw
-ODA0MjA1OTI1WhcNMTMwNDMwMjA1OTI1WjBwMQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEyMRIwEAYJKoZIhvcNAQkBFgN0YTIwHhcNMTEw
+MTI4MDI1NDEzWhcNMTMxMDI0MDI1NDEzWjBwMQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTEQMA4GA1UEAxQHY3MxX3RhMjEWMBQGCSqGSIb3DQEJARYHY3MxX3RhMjCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtw+m7fLn0sHeCalbfbpBFHaqJvz2pQvV
-QqXh8FsqFfBgt98GEwIGA+PfMblPYBztBFUoEb2Le52YaiwY6EWFpYvOTIc+kUbd
-dpHK0Q02AhsjGExEAaSOMAH+CahGKOMu5V9FZvmlgSrzlw3I7SLPWYJLzMbrFDVI
-SN+oWKQ8gGMCAwEAAaMdMBswDAYDVR0TAQH/BAIwADALBgNVHQ8EBAMCB4AwDQYJ
-KoZIhvcNAQELBQADgYEAeUj7jxH1i5QQsgn17t406WG3AFMLgpndNBPP3nNUEq9i
-JKibEB4E9jmsECCAcNXuKUAAka7lYs8cIhmyvzq1sbGJKdfCUMZcG9jlAvHBqfG8
-t2w3ZSslGDEQVnOwcTBuKvWCMYF1gQULEV7tKIUKzBceoMg3AaZ1cZqJickkHls=
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuMEZQrEmqTMfH1XQT21Do1V1x94YWmnM
+YrKm7PV4GTFaGths2EhmfRXU2v7dfEKgriLRUfUiVEl9FljPgrc+RcV+2oQo9rNc
+kGEnDnD++mw/IAqgEFCcdaQCYthoJmO6IRCJOasY+hB3Jk+s8VBB/Iz33OkgGXws
++wLHQG1p/wUCAwEAAaMgMB4wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4Aw
+DQYJKoZIhvcNAQELBQADgYEAS7BhW8magYoEktSYOfxFvTSQzGlPhglHP+km4qDm
+1GNTMoVI3hrvQ7uNGSlf+BO8J3aC0ndtgGjplqPNo9A8sSqUVH/ZlWEH99mEZ+q/
+IxAamiP3O6qDpDwYEpURGPsuk3yEYWxQfWesRDn18pqwifm9ceCuu1O8zpde7s0U
+rRQ=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/0D.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/0D.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,50 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p1_ta3/emailAddress=cs1_p1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:dd:8e:8a:e1:5f:20:65:74:0d:91:f3:d6:bd:76:
-                    67:58:99:ae:d7:99:bc:78:1f:d0:bb:d9:97:95:41:
-                    3b:42:4b:cc:cc:36:d8:27:00:2a:c3:27:92:4c:2d:
-                    5f:62:81:0c:b2:6d:1b:93:ca:a4:1c:18:09:8c:26:
-                    22:bf:80:a4:fe:48:37:87:64:63:32:95:41:8f:f6:
-                    35:98:93:f0:61:f2:4b:eb:b0:34:36:67:85:a1:9d:
-                    21:75:de:ab:9f:32:ae:3a:93:64:48:7f:ef:5a:fa:
-                    44:e2:1b:9f:9d:10:3c:c3:9c:90:dd:e1:fe:33:31:
-                    4a:22:cb:82:ab:84:2a:1e:af
+                    00:f6:03:62:59:9b:4b:42:80:bd:9e:2c:51:9d:d6:
+                    d3:5b:3e:36:b3:da:4b:05:ed:d1:77:b7:3e:dc:0a:
+                    87:20:89:51:84:e5:f9:f0:9d:fe:1d:e9:ad:ca:43:
+                    9d:41:8e:84:7d:eb:36:85:4f:14:da:18:ee:c9:c3:
+                    e7:f2:cd:9c:c4:11:16:52:d7:07:9f:f5:52:b7:7b:
+                    66:d5:ae:10:0f:fc:44:6d:a4:89:60:95:85:12:ca:
+                    31:34:26:1b:b5:e6:4f:5b:31:cc:76:76:c3:12:29:
+                    f6:64:b6:ea:44:da:e9:51:15:d6:1d:5a:91:cb:62:
+                    6e:da:c7:25:66:2f:30:52:17
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        3c:c2:d6:d7:6b:2a:e4:79:6d:b3:c8:48:64:b6:54:0c:30:d0:
-        3b:cd:4e:b8:f8:cd:0a:94:53:e5:10:b9:9e:93:f3:5a:a5:5e:
-        8c:4f:a6:d9:6c:98:ac:b6:e9:87:5e:85:ca:80:7f:34:5f:8a:
-        97:7a:f3:fc:8e:8d:de:6c:58:02:dc:ee:46:96:46:38:60:13:
-        7d:3a:5e:b8:32:e9:15:33:3f:0f:f2:21:2c:ea:ef:cf:0b:ff:
-        b8:07:58:2a:61:15:2c:fe:69:86:02:78:76:60:ce:51:30:8a:
-        26:ed:aa:9e:ee:b0:64:81:2f:0f:5c:a5:cd:47:cd:59:0b:3b:
-        aa:12
+        5e:5b:97:12:03:fe:8e:f1:93:90:83:b4:65:f5:4b:56:f6:69:
+        44:d7:12:f3:e7:56:bc:5f:f6:ae:5c:95:19:39:0f:0f:77:0f:
+        ef:78:bf:49:df:98:bb:91:02:3d:94:5e:90:d6:b0:a2:b0:d2:
+        db:70:29:01:d6:39:81:a5:c3:30:9c:b7:95:21:c7:13:36:9e:
+        f7:36:c5:be:7e:f4:9d:3b:71:2d:da:d9:07:55:67:62:34:33:
+        01:19:a7:ba:6f:ae:98:0e:22:a4:06:ad:16:ea:33:7f:e2:15:
+        83:4d:ac:ab:55:ff:aa:2b:15:a6:d2:73:e4:a4:43:53:6c:35:
+        9a:33
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBDTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBDTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMzAeFw0xMDA4MDQyMDU5MjVaFw0xMzA0MzAyMDU5MjVaMHYxCzAJBgNV
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTNaFw0xMzEwMjQwMjU0MTNaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdjorh
-XyBldA2R89a9dmdYma7Xmbx4H9C72ZeVQTtCS8zMNtgnACrDJ5JMLV9igQyybRuT
-yqQcGAmMJiK/gKT+SDeHZGMylUGP9jWYk/Bh8kvrsDQ2Z4WhnSF13qufMq46k2RI
-f+9a+kTiG5+dEDzDnJDd4f4zMUoiy4KrhCoerwIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQA8wtbXayrkeW2zyEhk
-tlQMMNA7zU64+M0KlFPlELmek/NapV6MT6bZbJistumHXoXKgH80X4qXevP8jo3e
-bFgC3O5GlkY4YBN9Ol64MukVMz8P8iEs6u/PC/+4B1gqYRUs/mmGAnh2YM5RMIom
-7aqe7rBkgS8PXKXNR81ZCzuqEg==
+AQkBFgpjczFfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2A2JZ
+m0tCgL2eLFGd1tNbPjaz2ksF7dF3tz7cCocgiVGE5fnwnf4d6a3KQ51BjoR96zaF
+TxTaGO7Jw+fyzZzEERZS1wef9VK3e2bVrhAP/ERtpIlglYUSyjE0Jhu15k9bMcx2
+dsMSKfZktupE2ulRFdYdWpHLYm7axyVmLzBSFwIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBeW5cSA/6O8ZOQ
+g7Rl9UtW9mlE1xLz51a8X/auXJUZOQ8Pdw/veL9J35i7kQI9lF6Q1rCisNLbcCkB
+1jmBpcMwnLeVIccTNp73NsW+fvSdO3Et2tkHVWdiNDMBGae6b66YDiKkBq0W6jN/
+4hWDTayrVf+qKxWm0nPkpENTbDWaMw==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/0E.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/0E.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Validity
-            Not Before: Aug  4 20:59:26 2010 GMT
-            Not After : Apr 30 20:59:26 2013 GMT
+            Not Before: Jan 28 02:54:18 2011 GMT
+            Not After : Oct 24 02:54:18 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs2_p1_ta3/emailAddress=cs2_p1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:c4:33:d5:18:cf:f2:82:d5:e6:c0:68:5a:3a:2a:
-                    50:30:fc:d6:df:61:cc:c1:35:16:cd:22:bf:72:42:
-                    2a:08:aa:93:f8:52:18:e9:e4:45:f3:d1:0a:a2:38:
-                    c6:44:73:e1:27:84:98:88:2f:f8:b2:b1:e2:46:39:
-                    bd:1f:cf:7a:bc:51:7f:31:e4:f5:b8:56:f3:54:4c:
-                    a5:57:ae:70:cc:f6:a4:46:8b:2c:7e:d3:6f:9b:c2:
-                    bb:e6:a4:f2:2a:15:e1:48:54:2c:63:fd:b3:eb:9e:
-                    6d:3a:bd:cc:3d:ce:3d:16:52:c1:6b:2a:82:8c:ca:
-                    60:50:6d:d6:aa:88:e7:c5:29
+                    00:bd:d7:4b:2b:72:c6:0b:98:3b:3d:ec:72:3f:64:
+                    78:bf:a2:c5:47:c1:20:2c:2c:b4:e5:0e:2c:be:aa:
+                    7c:ec:9f:ea:ec:06:24:fa:e3:0d:64:ce:4c:59:84:
+                    4c:c9:65:40:1f:d0:74:de:1b:90:49:ab:70:22:b7:
+                    9b:ae:13:98:df:66:44:b4:2c:82:8b:c8:43:54:c0:
+                    e3:bf:71:61:5a:96:4f:ef:86:f7:e0:d6:84:5d:81:
+                    40:0f:1d:d5:25:98:fb:19:52:4b:40:39:3e:2a:d2:
+                    2f:f6:15:7f:94:19:19:44:d7:85:c4:b5:9e:2a:e2:
+                    e3:ca:8d:a4:8f:84:22:b8:0d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,27 +29,27 @@
                 <EMPTY>
 
     Signature Algorithm: sha256WithRSAEncryption
-        04:c7:86:2b:af:5e:8c:eb:fc:5f:b4:ab:40:f2:57:b4:2c:db:
-        bc:14:6c:9c:49:5c:79:c9:55:a2:6b:ff:2a:d0:98:d7:66:83:
-        cc:48:58:f1:e8:a8:14:17:80:bc:18:bd:cf:d4:f9:02:a1:44:
-        6d:7c:91:f9:3c:97:03:28:2c:9e:c6:14:a9:8d:3a:bd:c7:c4:
-        ef:93:df:62:b5:41:2b:63:ed:16:a6:de:f2:f7:ab:54:b9:04:
-        b6:8f:ba:25:45:76:89:51:b2:c3:bc:67:db:78:93:3d:ae:77:
-        b2:0c:26:14:be:9e:89:ed:bb:f6:df:a4:b4:61:b1:18:bf:b8:
-        e6:38
+        12:18:e4:2e:db:dc:d1:db:98:c7:15:88:5e:10:47:9d:89:55:
+        b8:43:44:2b:30:ff:ca:b9:19:74:ff:f3:05:c3:60:bb:f9:3a:
+        5e:61:41:da:a3:03:59:cd:ae:39:d0:0b:83:e3:df:19:e5:1a:
+        92:79:09:d6:6d:e4:00:4c:32:45:cf:7f:3e:bc:96:c6:2e:7d:
+        80:d5:ae:11:c6:3d:4c:81:bb:97:39:9f:55:74:36:d5:19:63:
+        ea:25:43:bc:8e:ab:88:86:e7:53:8f:e8:30:9a:51:3e:f1:6f:
+        a2:21:43:b5:c8:d8:0b:84:65:a8:d5:06:55:f4:38:b9:35:90:
+        ee:47
 -----BEGIN CERTIFICATE-----
 MIICgDCCAemgAwIBAgIBDjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMzAeFw0xMDA4MDQyMDU5MjZaFw0xMzA0MzAyMDU5MjZaMHYxCzAJBgNV
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MThaFw0xMzEwMjQwMjU0MThaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczJfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczJfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEM9UY
-z/KC1ebAaFo6KlAw/NbfYczBNRbNIr9yQioIqpP4Uhjp5EXz0QqiOMZEc+EnhJiI
-L/iyseJGOb0fz3q8UX8x5PW4VvNUTKVXrnDM9qRGiyx+02+bwrvmpPIqFeFIVCxj
-/bPrnm06vcw9zj0WUsFrKoKMymBQbdaqiOfFKQIDAQABox4wHDAMBgNVHRMBAf8E
-AjAAMAwGA1UdEgEB/wQCMAAwDQYJKoZIhvcNAQELBQADgYEABMeGK69ejOv8X7Sr
-QPJXtCzbvBRsnElceclVomv/KtCY12aDzEhY8eioFBeAvBi9z9T5AqFEbXyR+TyX
-AygsnsYUqY06vcfE75PfYrVBK2PtFqbe8verVLkEto+6JUV2iVGyw7xn23iTPa53
-sgwmFL6eie279t+ktGGxGL+45jg=
+AQkBFgpjczJfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC910sr
+csYLmDs97HI/ZHi/osVHwSAsLLTlDiy+qnzsn+rsBiT64w1kzkxZhEzJZUAf0HTe
+G5BJq3Ait5uuE5jfZkS0LIKLyENUwOO/cWFalk/vhvfg1oRdgUAPHdUlmPsZUktA
+OT4q0i/2FX+UGRlE14XEtZ4q4uPKjaSPhCK4DQIDAQABox4wHDAMBgNVHRMBAf8E
+AjAAMAwGA1UdEgEB/wQCMAAwDQYJKoZIhvcNAQELBQADgYEAEhjkLtvc0duYxxWI
+XhBHnYlVuENEKzD/yrkZdP/zBcNgu/k6XmFB2qMDWc2uOdALg+PfGeUaknkJ1m3k
+AEwyRc9/PryWxi59gNWuEcY9TIG7lzmfVXQ21Rlj6iVDvI6riIbnU4/oMJpRPvFv
+oiFDtcjYC4RlqNUGVfQ4uTWQ7kc=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/0F.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/0F.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -12,43 +12,43 @@
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:ce:9e:aa:9a:44:62:e4:9d:f2:cd:d1:ef:39:cc:
-                    cb:b8:e9:1a:06:cf:7e:e4:e1:99:52:e0:5a:17:a9:
-                    78:b3:e7:25:c0:97:f8:72:d4:75:50:c5:d9:84:84:
-                    90:cc:53:5e:46:c0:66:d8:0a:76:0c:cf:f7:ff:f8:
-                    fd:e9:f4:60:88:49:74:97:3d:34:f0:90:da:97:5d:
-                    40:1e:78:cb:bf:84:1b:c2:7e:70:cb:b6:79:26:7d:
-                    62:a1:63:60:0b:9f:b3:5a:5f:13:a8:1c:5e:f5:39:
-                    0c:14:d4:67:58:16:09:3b:cf:5c:4a:4a:e6:17:80:
-                    90:69:b5:6d:8d:c8:27:88:9d
+                    00:cd:90:51:4d:d8:59:5e:67:1d:1b:3d:b6:b7:1c:
+                    ff:05:97:c5:12:37:91:68:81:11:2b:85:ce:55:b8:
+                    7a:99:72:c3:53:4a:4e:b6:82:01:7a:44:d1:b4:ea:
+                    12:e0:1f:6a:36:5c:c1:f9:56:a4:cb:a2:ff:4a:d8:
+                    cc:fb:c1:19:3a:0c:e8:c0:3a:ac:f5:d2:32:1c:4e:
+                    2d:16:60:df:84:ae:3e:7b:b5:c3:5c:ac:da:5a:b9:
+                    bc:61:25:c1:ec:d7:df:f9:34:c0:5f:f4:45:56:a1:
+                    a1:f3:43:e1:ac:61:24:c7:ee:ba:89:6f:fa:36:b3:
+                    7d:3a:b1:be:fa:b2:3f:53:15
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        41:c7:40:05:62:dd:88:6f:07:66:78:9b:56:0d:55:77:9e:b7:
-        d1:08:f6:b1:59:cd:85:72:b3:19:fd:0f:c7:4f:a9:54:52:6a:
-        4b:f0:c2:d1:35:6c:1c:cd:71:ee:6f:61:c3:a9:a2:f9:13:68:
-        6a:56:f9:95:c6:da:82:61:9d:de:dd:4b:e1:42:2f:db:80:62:
-        49:31:45:60:c8:d6:3d:1b:49:82:6f:df:1c:a4:ca:01:9a:6f:
-        bc:ff:9e:a8:ec:42:f8:22:f9:70:b3:3a:e6:e2:3e:d2:18:58:
-        89:95:d8:01:fe:b1:25:5e:bc:a2:70:1c:59:5d:e5:af:b1:02:
-        ac:d3
+        49:8f:d8:83:5e:c9:fa:54:40:51:5f:01:ee:23:32:9a:88:c6:
+        c2:57:49:42:61:38:2c:62:86:05:bc:7a:2f:85:5a:e9:d5:73:
+        8e:1d:3f:07:34:bf:69:41:a1:9b:7a:77:50:9f:b0:4a:c7:af:
+        bd:c8:e6:bd:9e:ad:85:85:98:12:e9:ce:0c:e3:3d:55:61:6b:
+        e7:e2:36:79:d4:78:0f:da:ea:b8:7e:18:33:80:48:1f:b8:25:
+        f1:30:d5:a1:59:86:29:5c:dd:a3:74:27:b4:fa:90:06:43:bb:
+        01:a1:72:af:7c:fc:e8:00:fa:6c:ed:7d:55:77:54:13:67:94:
+        6a:31
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBDzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBDzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
 Q0ExX3RhMzAeFw0wOTAxMDEwMTAxMDFaFw0wOTAxMDIwMTAxMDFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczNfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczNfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOnqqa
-RGLknfLN0e85zMu46RoGz37k4ZlS4FoXqXiz5yXAl/hy1HVQxdmEhJDMU15GwGbY
-CnYMz/f/+P3p9GCISXSXPTTwkNqXXUAeeMu/hBvCfnDLtnkmfWKhY2ALn7NaXxOo
-HF71OQwU1GdYFgk7z1xKSuYXgJBptW2NyCeInQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBBx0AFYt2IbwdmeJtW
-DVV3nrfRCPaxWc2FcrMZ/Q/HT6lUUmpL8MLRNWwczXHub2HDqaL5E2hqVvmVxtqC
-YZ3e3UvhQi/bgGJJMUVgyNY9G0mCb98cpMoBmm+8/56o7EL4Ivlwszrm4j7SGFiJ
-ldgB/rElXryicBxZXeWvsQKs0w==
+AQkBFgpjczNfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNkFFN
+2FleZx0bPba3HP8Fl8USN5FogRErhc5VuHqZcsNTSk62ggF6RNG06hLgH2o2XMH5
+VqTLov9K2Mz7wRk6DOjAOqz10jIcTi0WYN+Erj57tcNcrNpaubxhJcHs19/5NMBf
+9EVWoaHzQ+GsYSTH7rqJb/o2s306sb76sj9TFQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBJj9iDXsn6VEBR
+XwHuIzKaiMbCV0lCYTgsYoYFvHovhVrp1XOOHT8HNL9pQaGbendQn7BKx6+9yOa9
+nq2FhZgS6c4M4z1VYWvn4jZ51HgP2uq4fhgzgEgfuCXxMNWhWYYpXN2jdCe0+pAG
+Q7sBoXKvfPzoAPps7X1Vd1QTZ5RqMQ==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/10.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/10.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -12,43 +12,43 @@
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:a5:72:6c:c4:dc:df:15:f5:b0:2f:fb:d2:e2:d9:
-                    f2:2c:5e:0a:c5:04:34:99:0f:06:13:9a:e8:86:2d:
-                    44:2f:57:67:81:a1:93:0e:cd:b5:4b:ca:1a:4b:31:
-                    c6:a7:73:b3:70:66:21:03:6a:cd:a5:bf:4a:6d:96:
-                    d8:50:9e:95:d7:42:84:86:80:f1:15:3f:5c:85:8f:
-                    dd:ee:13:61:c9:2c:71:c1:c1:cb:e8:e9:4d:eb:ce:
-                    d9:57:98:2d:93:81:0e:fb:6d:00:31:9d:db:6f:c2:
-                    aa:b1:36:65:0d:8d:82:7b:e7:df:7c:03:76:f9:b8:
-                    6c:6e:7e:13:5d:85:ac:c0:89
+                    00:e2:60:08:58:af:0f:1b:38:07:8c:9d:b6:88:c5:
+                    99:34:c6:da:7f:37:6b:2e:73:4c:d4:4d:96:c8:9f:
+                    66:61:4c:cc:97:79:b8:af:68:50:3a:4a:78:d1:57:
+                    9a:b4:f3:4d:20:72:e9:5d:eb:99:9f:0d:04:a9:f0:
+                    5b:3f:34:29:b8:b5:28:e1:ea:43:9d:0e:ed:70:4a:
+                    d1:52:13:41:2c:10:6c:5b:bc:8f:65:ff:3b:fc:b6:
+                    27:d7:e9:dc:3b:f8:62:d5:45:85:a5:c1:b7:3d:19:
+                    f9:78:78:90:a4:b6:a5:42:ef:82:f5:17:80:80:63:
+                    9d:2d:51:24:3e:a1:4f:cc:17
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        5f:7c:e0:ae:58:97:b0:36:1e:a7:28:61:9c:0d:2e:cb:34:22:
-        b3:18:7d:d9:0d:2e:2e:0e:0c:79:1f:5e:14:37:c3:cf:7a:41:
-        60:76:a5:0e:ea:c9:eb:f3:5c:7f:0f:39:2e:dc:b8:58:9b:d9:
-        f6:37:f9:53:22:a1:07:57:f9:4e:e3:0e:5b:31:15:7e:88:8d:
-        78:48:18:d5:f9:3a:dd:0b:4a:41:5b:c1:e0:32:8b:3a:ef:ad:
-        36:c8:26:e8:25:52:f7:94:19:99:6e:ff:ec:ac:f3:34:6e:f4:
-        ef:73:e9:6f:2c:8e:c3:96:09:b5:25:68:f9:ce:5c:40:07:47:
-        36:8a
+        a1:8e:31:d1:59:5e:8a:db:6f:b4:46:46:46:80:17:32:c7:f4:
+        47:db:6e:ff:48:8e:1b:0c:5a:ae:aa:31:74:da:37:df:d4:01:
+        1a:6a:7f:7d:16:1a:5c:d8:a3:56:26:9b:c4:47:ff:4b:40:69:
+        3d:a8:e0:25:da:31:51:61:bc:08:b0:47:1a:2d:ae:56:e9:ba:
+        a7:cb:c5:bd:f2:8d:d7:62:72:9d:ff:4d:9f:f7:63:cc:0c:26:
+        19:f1:41:04:f2:82:06:a8:7c:22:ce:7f:af:5a:57:8c:ba:ca:
+        21:8f:95:5d:80:b0:37:6b:c1:7a:ea:3a:7c:3f:c6:bf:42:d7:
+        d4:e4
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBEDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBEDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
 Q0ExX3RhMzAeFw0zNTAxMDEwMTAxMDFaFw0zNTAxMDIwMTAxMDFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczRfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczRfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClcmzE
-3N8V9bAv+9Li2fIsXgrFBDSZDwYTmuiGLUQvV2eBoZMOzbVLyhpLMcanc7NwZiED
-as2lv0ptlthQnpXXQoSGgPEVP1yFj93uE2HJLHHBwcvo6U3rztlXmC2TgQ77bQAx
-ndtvwqqxNmUNjYJ75998A3b5uGxufhNdhazAiQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBffOCuWJewNh6nKGGc
-DS7LNCKzGH3ZDS4uDgx5H14UN8PPekFgdqUO6snr81x/Dzku3LhYm9n2N/lTIqEH
-V/lO4w5bMRV+iI14SBjV+TrdC0pBW8HgMos67602yCboJVL3lBmZbv/srPM0bvTv
-c+lvLI7Dlgm1JWj5zlxAB0c2ig==
+AQkBFgpjczRfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDiYAhY
+rw8bOAeMnbaIxZk0xtp/N2suc0zUTZbIn2ZhTMyXebivaFA6SnjRV5q0800gculd
+65mfDQSp8Fs/NCm4tSjh6kOdDu1wStFSE0EsEGxbvI9l/zv8tifX6dw7+GLVRYWl
+wbc9Gfl4eJCktqVC74L1F4CAY50tUSQ+oU/MFwIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQChjjHRWV6K22+0
+RkZGgBcyx/RH227/SI4bDFquqjF02jff1AEaan99Fhpc2KNWJpvER/9LQGk9qOAl
+2jFRYbwIsEcaLa5W6bqny8W98o3XYnKd/02f92PMDCYZ8UEE8oIGqHwizn+vWleM
+usohj5VdgLA3a8F66jp8P8a/QtfU5A==
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/11.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 17 (0x11)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
+        Validity
+            Not Before: Jan 28 02:54:19 2011 GMT
+            Not After : Oct 24 02:54:19 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs5_p1_ta3/emailAddress=cs5_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:f6:3f:57:e4:be:9d:29:77:e5:df:08:72:be:67:
+                    5c:c6:37:e7:ad:62:33:22:74:bb:f2:82:f6:1d:f1:
+                    42:ec:56:c2:6e:d0:bc:f3:e6:a6:91:a1:db:4c:b8:
+                    27:c9:38:3d:c9:d3:e0:78:d0:51:23:22:b2:3f:6f:
+                    4b:1e:14:53:3e:fb:5a:58:f6:fa:f9:cf:ca:ef:89:
+                    34:cd:51:c1:ee:89:32:c4:c1:30:fc:63:51:13:4d:
+                    b4:55:fd:a5:6c:fd:ea:3c:f7:ea:8c:7d:3e:fb:0d:
+                    0e:f7:70:c7:73:ce:01:98:77:fe:db:1f:1c:32:e3:
+                    59:ae:26:b1:1d:eb:3c:83:51
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Encipher Only
+    Signature Algorithm: sha256WithRSAEncryption
+        c9:8a:74:1f:0a:fe:1b:e0:19:64:5f:27:2b:1b:e3:d9:45:a0:
+        19:64:00:d8:12:f5:35:e5:65:70:4d:f2:b3:f2:b6:89:81:12:
+        84:56:f7:11:00:ac:79:f8:9f:c6:4e:77:71:3a:f0:da:50:6b:
+        f3:ce:cc:44:38:77:00:c2:d7:33:6f:f4:72:34:33:28:4f:d2:
+        fa:aa:2e:8d:e0:37:2b:ac:ab:b5:9b:ad:63:d8:7a:79:07:c2:
+        3b:f4:1b:9a:b6:93:1f:31:26:6e:3f:38:a3:9c:c9:19:e4:6e:
+        17:6d:49:af:f8:c5:55:cf:24:c8:ee:57:ce:81:e3:75:e1:c3:
+        27:cf
+-----BEGIN CERTIFICATE-----
+MIICfzCCAeigAwIBAgIBETANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTlaFw0xMzEwMjQwMjU0MTlaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczVfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczVfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2P1fk
+vp0pd+XfCHK+Z1zGN+etYjMidLvygvYd8ULsVsJu0Lzz5qaRodtMuCfJOD3J0+B4
+0FEjIrI/b0seFFM++1pY9vr5z8rviTTNUcHuiTLEwTD8Y1ETTbRV/aVs/eo89+qM
+fT77DQ73cMdzzgGYd/7bHxwy41muJrEd6zyDUQIDAQABox0wGzAMBgNVHRMBAf8E
+AjAAMAsGA1UdDwQEAwIAATANBgkqhkiG9w0BAQsFAAOBgQDJinQfCv4b4BlkXycr
+G+PZRaAZZADYEvU15WVwTfKz8raJgRKEVvcRAKx5+J/GTndxOvDaUGvzzsxEOHcA
+wtczb/RyNDMoT9L6qi6N4DcrrKu1m61j2Hp5B8I79BuatpMfMSZuPzijnMkZ5G4X
+bUmv+MVVzyTI7lfOgeN14cMnzw==
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/12.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/12.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -3,52 +3,52 @@
         Version: 3 (0x2)
         Serial Number: 18 (0x12)
         Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta3/emailAddress=pubCA2_ta3
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Validity
-            Not Before: Aug  4 20:59:27 2010 GMT
-            Not After : Apr 30 20:59:27 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p2_ta3/emailAddress=cs1_p2_ta3
+            Not Before: Jan 28 02:54:19 2011 GMT
+            Not After : Oct 24 02:54:19 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs6_p1_ta3/emailAddress=cs6_p1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:d0:1e:f6:58:e2:2b:d0:15:fe:da:5c:5d:11:84:
-                    b9:7c:65:42:51:e2:92:9e:43:c0:71:c2:0b:ba:4b:
-                    07:60:14:08:27:16:f5:2c:16:44:6d:89:0e:cf:6f:
-                    47:2d:ef:12:df:0d:9d:9c:94:cf:4e:f0:00:1c:07:
-                    3b:6c:e5:10:61:97:f3:c0:20:12:6c:00:87:9d:95:
-                    e4:3b:14:de:7d:97:77:59:9a:2c:9a:f6:a9:0c:20:
-                    3f:0b:da:a9:13:32:d3:a9:a7:5f:38:9f:b5:7f:19:
-                    0f:f1:ff:c0:a6:7f:e9:76:24:66:72:29:ce:6d:6a:
-                    a2:c3:3e:34:0a:34:b8:c4:9b
+                    00:c5:6c:6d:f1:28:4b:56:5d:cf:eb:08:28:a6:85:
+                    c9:c4:1a:e6:f9:ca:41:a3:80:c6:52:63:78:43:23:
+                    f9:9c:c2:4a:75:d1:fd:c4:d2:1d:da:c7:e1:d6:a7:
+                    5e:16:ad:58:c2:55:db:a1:59:06:58:0f:04:1d:ef:
+                    68:22:1c:ec:c3:5c:8e:f9:ab:18:5f:63:fc:72:d8:
+                    30:4d:c3:ac:b5:88:d9:be:32:fd:fb:04:e8:7e:86:
+                    89:96:f7:a9:aa:09:62:f6:db:42:5d:91:90:82:4a:
+                    75:ea:7a:a2:3a:13:05:74:c9:c7:75:71:ad:61:3e:
+                    a1:a3:40:63:04:44:9a:a7:e1
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
-                Digital Signature
+            X509v3 Key Usage: critical
+                Encipher Only
     Signature Algorithm: sha256WithRSAEncryption
-        2f:4c:87:b3:14:32:98:dd:06:48:ce:26:54:7d:49:d7:3d:6a:
-        a3:ac:52:bc:55:9e:9f:09:82:1a:ea:cc:c3:a4:a2:83:4e:98:
-        73:cd:29:f5:0b:46:4f:f7:e6:97:cb:96:8f:60:ca:22:b0:dc:
-        37:0e:7b:89:4c:24:13:aa:9a:4e:65:f7:66:f2:3c:99:e3:12:
-        e4:59:db:b9:9f:46:a4:27:19:1b:90:f3:2b:8d:01:88:78:81:
-        34:90:0e:14:a9:80:05:f1:19:28:22:e1:00:f3:e4:a6:e1:28:
-        0d:d0:36:ac:9f:1c:05:9c:17:e3:0f:2b:40:6b:1a:7a:07:60:
-        8c:b5
+        ac:fb:c4:5d:a4:05:8c:fa:cf:99:69:0b:25:aa:5f:75:74:0d:
+        b0:96:10:14:71:6c:97:ba:2b:e6:f6:19:80:da:9d:25:89:2f:
+        19:04:ec:c8:2b:da:2a:bc:5a:67:4f:55:fb:f4:e7:c1:de:7e:
+        d3:d7:5c:03:34:00:f2:25:5d:55:75:b4:bc:5f:88:13:a0:ff:
+        8d:6b:ae:78:6f:4e:b8:75:f6:8b:7e:5f:85:ac:1c:2a:62:b9:
+        38:72:84:f3:43:50:23:40:79:c8:7b:5c:6d:2a:97:be:76:a8:
+        98:73:e4:c2:51:d2:46:1b:37:c3:32:72:a2:83:56:7e:73:46:
+        1e:cd
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBEjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBEjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EyX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0EyX3RhMzAeFw0xMDA4MDQyMDU5MjdaFw0xMzA0MzAyMDU5MjdaMHYxCzAJBgNV
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTlaFw0xMzEwMjQwMjU0MTlaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
-MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDJfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDJfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQHvZY
-4ivQFf7aXF0RhLl8ZUJR4pKeQ8Bxwgu6SwdgFAgnFvUsFkRtiQ7Pb0ct7xLfDZ2c
-lM9O8AAcBzts5RBhl/PAIBJsAIedleQ7FN59l3dZmiya9qkMID8L2qkTMtOpp184
-n7V/GQ/x/8Cmf+l2JGZyKc5taqLDPjQKNLjEmwIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAvTIezFDKY3QZIziZU
-fUnXPWqjrFK8VZ6fCYIa6szDpKKDTphzzSn1C0ZP9+aXy5aPYMoisNw3DnuJTCQT
-qppOZfdm8jyZ4xLkWdu5n0akJxkbkPMrjQGIeIE0kA4UqYAF8RkoIuEA8+Sm4SgN
-0DasnxwFnBfjDytAaxp6B2CMtQ==
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczZfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczZfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDFbG3x
+KEtWXc/rCCimhcnEGub5ykGjgMZSY3hDI/mcwkp10f3E0h3ax+HWp14WrVjCVduh
+WQZYDwQd72giHOzDXI75qxhfY/xy2DBNw6y1iNm+Mv37BOh+homW96mqCWL220Jd
+kZCCSnXqeqI6EwV0ycd1ca1hPqGjQGMERJqn4QIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIAATANBgkqhkiG9w0BAQsFAAOBgQCs+8RdpAWM+s+Z
+aQslql91dA2wlhAUcWyXuivm9hmA2p0liS8ZBOzIK9oqvFpnT1X79OfB3n7T11wD
+NADyJV1VdbS8X4gToP+Na654b064dfaLfl+FrBwqYrk4coTzQ1AjQHnIe1xtKpe+
+dqiYc+TCUdJGGzfDMnKig1Z+c0YezQ==
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/13.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,52 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 19 (0x13)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
+        Validity
+            Not Before: Jan 28 02:54:19 2011 GMT
+            Not After : Oct 24 02:54:19 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs7_p1_ta3/emailAddress=cs7_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ba:54:8d:a5:e9:70:76:e3:0b:e5:b9:8f:21:1f:
+                    ef:1e:24:1b:fe:d5:67:95:ba:23:6b:f6:55:69:92:
+                    09:5a:a2:2b:09:72:e7:e5:a7:fb:04:59:cf:27:3f:
+                    8a:b8:28:39:d9:02:24:eb:7a:44:73:6c:29:74:8f:
+                    5a:a4:ff:c4:e1:40:5e:77:8f:24:8c:4e:d8:e0:31:
+                    cf:e6:83:e4:4d:5c:77:29:ae:21:58:84:9f:43:d2:
+                    8e:cb:d4:75:79:96:59:78:00:de:0f:05:25:b0:bf:
+                    81:35:15:27:ac:58:28:09:7a:49:49:17:49:f1:f8:
+                    b9:b7:a1:7f:66:2b:b3:25:7b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+    Signature Algorithm: sha256WithRSAEncryption
+        9f:fc:6d:b4:57:4b:9e:63:53:a8:23:d0:d1:e7:cc:87:bc:37:
+        c6:a7:b0:00:ab:f2:a0:c5:e8:07:56:7a:3d:e3:ff:0e:56:ce:
+        40:78:09:2e:56:6b:9f:13:99:da:50:c8:90:43:6a:e2:88:b7:
+        7d:7d:25:ef:8f:ca:f7:e4:89:f1:07:15:b4:db:48:82:c7:40:
+        5f:58:fe:07:8d:4e:f1:30:eb:99:97:fe:58:67:04:52:34:88:
+        d5:37:c2:fb:a8:07:c3:47:88:5e:11:0b:aa:f0:18:bb:a0:a1:
+        9c:3e:90:b4:44:b9:e5:28:74:6e:9b:ba:e5:40:63:d2:11:aa:
+        9c:bb
+-----BEGIN CERTIFICATE-----
+MIICcjCCAdugAwIBAgIBEzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTlaFw0xMzEwMjQwMjU0MTlaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczdfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczdfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6VI2l
+6XB24wvluY8hH+8eJBv+1WeVuiNr9lVpkglaoisJcuflp/sEWc8nP4q4KDnZAiTr
+ekRzbCl0j1qk/8ThQF53jySMTtjgMc/mg+RNXHcpriFYhJ9D0o7L1HV5lll4AN4P
+BSWwv4E1FSesWCgJeklJF0nx+Lm3oX9mK7MlewIDAQABoxAwDjAMBgNVHRMBAf8E
+AjAAMA0GCSqGSIb3DQEBCwUAA4GBAJ/8bbRXS55jU6gj0NHnzIe8N8ansACr8qDF
+6AdWej3j/w5WzkB4CS5Wa58TmdpQyJBDauKIt319Je+PyvfkifEHFbTbSILHQF9Y
+/geNTvEw65mX/lhnBFI0iNU3wvuoB8NHiF4RC6rwGLugoZw+kLREueUodG6buuVA
+Y9IRqpy7
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/14.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/14.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -3,52 +3,52 @@
         Version: 3 (0x2)
         Serial Number: 20 (0x14)
         Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA3_ta3/emailAddress=pubCA3_ta3
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Validity
-            Not Before: Aug  4 20:59:27 2010 GMT
-            Not After : Apr 30 20:59:27 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p3_ta3/emailAddress=cs1_p3_ta3
+            Not Before: Jan 28 02:54:20 2011 GMT
+            Not After : Oct 24 02:54:20 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs8_p1_ta3/emailAddress=cs8_p1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:bc:82:7d:df:49:1f:1f:4c:7e:ee:25:51:96:e4:
-                    49:a8:fb:ee:b0:51:b5:10:e9:cc:f0:36:07:59:61:
-                    37:a8:95:70:5f:53:3e:54:ef:02:46:d9:12:84:20:
-                    8f:65:c4:53:99:e6:cc:d9:de:d0:e5:d2:51:2b:3d:
-                    3d:08:88:a3:35:d3:7e:bf:c9:70:d3:65:81:16:30:
-                    18:0e:7f:22:66:52:05:65:d0:e4:65:11:06:8d:df:
-                    a1:97:df:74:c4:f3:be:d2:6f:ee:12:8d:1a:dd:15:
-                    b8:e4:7e:cd:12:ce:d4:47:4d:d5:e9:d7:c8:3b:e0:
-                    0a:43:7a:4a:cc:11:6a:38:31
+                    00:ad:72:4f:d0:b8:2b:c4:74:c7:91:71:75:5e:89:
+                    88:2f:d8:bd:af:cd:40:a0:7b:48:87:a4:dc:63:96:
+                    05:79:4c:ba:d7:80:ec:bf:7f:37:9e:6f:62:4c:d6:
+                    e9:10:f0:46:1b:5c:23:f7:57:a1:1f:63:77:b5:4e:
+                    05:fd:17:7e:4a:a6:6d:ed:46:39:c7:e0:45:7b:b7:
+                    6f:39:27:64:57:35:4a:d8:01:37:c6:8e:5b:af:28:
+                    d7:a9:6c:94:23:4b:93:e1:e5:ab:db:7a:0d:b0:2b:
+                    1d:e8:99:f5:2e:89:e9:f6:37:aa:a8:09:fb:e2:0a:
+                    32:59:0b:ec:1b:4e:e5:ad:43
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Key Usage: 
+                CA:TRUE
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        33:5c:cd:75:6d:2d:67:ce:9a:bb:c9:86:9d:07:59:66:9c:b2:
-        36:0f:a6:6d:5a:a4:dc:11:0a:b6:0a:80:78:5d:93:8a:c6:6b:
-        e1:81:01:70:31:5b:0c:ad:8e:04:35:4a:6b:c6:54:d5:28:fd:
-        8d:bb:c6:90:b2:66:58:3a:8c:a6:e5:98:dc:e5:ed:5f:ad:55:
-        48:99:68:2a:7f:5a:b4:48:e7:96:29:97:9a:af:d5:b4:be:08:
-        e9:cd:34:7f:15:98:3c:f7:30:f6:a8:ed:4b:4a:57:f5:1c:18:
-        2a:96:36:f6:ec:a0:d4:bc:50:b6:68:0f:cd:ac:44:0c:97:c5:
-        89:59
+        65:b5:1a:f3:d3:d8:24:ba:ef:c8:38:30:6f:df:d5:06:2d:a3:
+        f0:26:48:7f:77:28:a6:3b:48:40:36:bf:16:50:92:aa:12:33:
+        e9:70:59:be:7a:72:66:b8:64:5e:d8:22:c7:c8:29:a5:e3:00:
+        31:11:91:e6:b5:1c:00:6e:76:be:07:e2:35:62:88:c9:d9:f5:
+        f0:08:bf:2d:b5:e1:db:31:55:86:ee:0b:ee:cd:2f:6b:e0:82:
+        15:42:46:d1:1a:92:b3:f1:7e:4b:1e:65:9e:7c:a3:95:aa:48:
+        7f:23:c8:12:b2:dd:23:57:14:87:94:b5:62:be:bf:ba:44:6e:
+        23:af
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBFDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIIChTCCAe6gAwIBAgIBFDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EzX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0EzX3RhMzAeFw0xMDA4MDQyMDU5MjdaFw0xMzA0MzAyMDU5MjdaMHYxCzAJBgNV
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MjBaFw0xMzEwMjQwMjU0MjBaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
-MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDNfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDNfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8gn3f
-SR8fTH7uJVGW5Emo++6wUbUQ6czwNgdZYTeolXBfUz5U7wJG2RKEII9lxFOZ5szZ
-3tDl0lErPT0IiKM1036/yXDTZYEWMBgOfyJmUgVl0ORlEQaN36GX33TE877Sb+4S
-jRrdFbjkfs0SztRHTdXp18g74ApDekrMEWo4MQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAzXM11bS1nzpq7yYad
-B1lmnLI2D6ZtWqTcEQq2CoB4XZOKxmvhgQFwMVsMrY4ENUprxlTVKP2Nu8aQsmZY
-Ooym5Zjc5e1frVVImWgqf1q0SOeWKZear9W0vgjpzTR/FZg89zD2qO1LSlf1HBgq
-ljb27KDUvFC2aA/NrEQMl8WJWQ==
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczhfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczhfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtck/Q
+uCvEdMeRcXVeiYgv2L2vzUCge0iHpNxjlgV5TLrXgOy/fzeeb2JM1ukQ8EYbXCP3
+V6EfY3e1TgX9F35Kpm3tRjnH4EV7t285J2RXNUrYATfGjluvKNepbJQjS5Ph5avb
+eg2wKx3omfUuien2N6qoCfviCjJZC+wbTuWtQwIDAQABoyMwITAPBgNVHRMBAf8E
+BTADAQH/MA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBltRrz09gk
+uu/IODBv39UGLaPwJkh/dyimO0hANr8WUJKqEjPpcFm+enJmuGRe2CLHyCml4wAx
+EZHmtRwAbna+B+I1YojJ2fXwCL8tteHbMVWG7gvuzS9r4IIVQkbRGpKz8X5LHmWe
+fKOVqkh/I8gSst0jVxSHlLVivr+6RG4jrw==
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/15.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 21 (0x15)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs8_p1_ta3/emailAddress=cs8_p1_ta3
+        Validity
+            Not Before: Jan 28 02:54:20 2011 GMT
+            Not After : Oct 24 02:54:20 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_cs8_p1_ta3/emailAddress=cs1_cs8_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b7:b3:67:af:2e:4f:cd:e6:84:61:80:0a:6a:0d:
+                    d7:48:3e:34:76:b9:51:d4:47:4c:20:d1:cb:29:f3:
+                    cb:30:f9:de:be:4c:dd:3b:7c:8b:ad:2a:b8:90:49:
+                    f1:e5:e0:93:e9:c4:72:41:b7:c7:1e:ad:fb:6c:84:
+                    51:3f:b6:58:cc:15:7a:cf:3c:16:fa:e1:29:2e:57:
+                    90:90:5b:d1:55:a6:0c:76:6a:85:6c:19:71:0b:33:
+                    cc:93:bb:4e:02:59:d0:08:dc:cb:8c:17:1f:40:de:
+                    fb:ba:b5:24:e0:f0:b3:df:b1:94:d1:7b:80:d9:74:
+                    a9:44:4e:b7:eb:cd:cf:62:ed
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        7f:59:dd:b6:d7:6a:bf:e7:c2:c0:53:9c:8f:90:e3:e5:3a:75:
+        04:35:ef:d8:39:f9:53:e6:1e:bf:8b:fd:c3:19:21:81:70:09:
+        a1:e6:89:6f:9d:3c:f3:9c:c5:00:5b:0c:7d:e3:13:de:cf:1b:
+        10:2b:ab:c3:d2:77:76:03:59:ef:43:39:a9:de:78:e9:a9:a1:
+        fb:8b:b4:c7:ec:37:97:5b:65:ee:af:e4:66:c7:42:a8:24:73:
+        d2:3f:37:fc:9f:79:93:53:88:81:0b:f6:be:f7:ac:f8:9d:37:
+        c8:c6:66:81:2e:f0:8a:0e:41:95:24:9d:4c:90:50:94:51:45:
+        46:8f
+-----BEGIN CERTIFICATE-----
+MIICijCCAfOgAwIBAgIBFTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKY3M4X3AxX3RhMzEZMBcGCSqGSIb3DQEJARYKY3M4
+X3AxX3RhMzAeFw0xMTAxMjgwMjU0MjBaFw0xMzEwMjQwMjU0MjBaMH4xCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRcwFQYDVQQDFA5jczFfY3M4X3AxX3RhMzEdMBsGCSqG
+SIb3DQEJARYOY3MxX2NzOF9wMV90YTMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBALezZ68uT83mhGGACmoN10g+NHa5UdRHTCDRyynzyzD53r5M3Tt8i60quJBJ
+8eXgk+nEckG3xx6t+2yEUT+2WMwVes88FvrhKS5XkJBb0VWmDHZqhWwZcQszzJO7
+TgJZ0Ajcy4wXH0De+7q1JODws9+xlNF7gNl0qUROt+vNz2LtAgMBAAGjIDAeMAwG
+A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4GBAH9Z
+3bbXar/nwsBTnI+Q4+U6dQQ179g5+VPmHr+L/cMZIYFwCaHmiW+dPPOcxQBbDH3j
+E97PGxArq8PSd3YDWe9DOaneeOmpofuLtMfsN5dbZe6v5GbHQqgkc9I/N/yfeZNT
+iIEL9r73rPidN8jGZoEu8IoOQZUknUyQUJRRRUaP
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/16.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,54 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 22 (0x16)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA4_ta3/emailAddress=pubCA4_ta3
-        Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p4_ta3/emailAddress=cs1_p4_ta3
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:bf:42:c9:e7:65:b4:c1:88:85:cc:9a:49:29:db:
-                    64:05:14:60:b4:c4:ab:44:7d:86:51:9d:c0:ba:c2:
-                    41:c2:80:fc:e7:ea:26:14:f2:73:af:90:98:98:c8:
-                    ed:eb:89:d4:1f:a7:9a:7a:4f:8d:0a:4a:b5:54:de:
-                    3c:1a:5c:cc:18:1d:39:dd:f5:2b:97:a6:1c:b3:75:
-                    4c:da:1f:86:bb:1f:0f:67:b1:a0:e9:1c:f9:21:e0:
-                    2e:98:de:5c:64:66:7f:39:42:78:14:a5:ce:2c:b2:
-                    9b:fc:f2:54:a1:a2:af:cc:73:80:a3:6d:d0:d3:29:
-                    f9:ae:9b:e1:d6:9c:3a:19:89
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Key Usage: 
-                Digital Signature
-    Signature Algorithm: sha256WithRSAEncryption
-        1b:81:d7:ec:0d:02:2c:b0:29:3c:62:f1:f5:e3:71:50:ac:a2:
-        d5:66:86:8c:98:c2:5a:79:2c:25:cf:a1:55:0f:4f:17:5d:93:
-        c6:89:fc:d6:14:ad:3e:2a:56:4e:ab:2d:1b:5d:37:30:2e:50:
-        78:22:d7:74:46:63:76:a0:23:5c:77:ad:ae:47:7e:db:a0:7e:
-        2c:17:27:df:0a:e8:2e:ff:4d:58:53:99:d2:36:08:78:45:a6:
-        af:eb:e9:fd:48:a1:e1:20:f1:70:ad:e9:77:51:d8:22:e5:e6:
-        f2:a6:06:04:31:eb:fe:3c:f1:75:5f:51:36:a9:b1:fc:8f:6c:
-        d8:4e
------BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBFjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTETMBEGA1UEAxQKcHViQ0E0X3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0E0X3RhMzAeFw0xMDA4MDQyMDU5MjhaFw0xMzA0MzAyMDU5MjhaMHYxCzAJBgNV
-BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
-MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDRfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDRfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/Qsnn
-ZbTBiIXMmkkp22QFFGC0xKtEfYZRncC6wkHCgPzn6iYU8nOvkJiYyO3ridQfp5p6
-T40KSrVU3jwaXMwYHTnd9SuXphyzdUzaH4a7Hw9nsaDpHPkh4C6Y3lxkZn85QngU
-pc4sspv88lShoq/Mc4CjbdDTKfmum+HWnDoZiQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAbgdfsDQIssCk8YvH1
-43FQrKLVZoaMmMJaeSwlz6FVD08XXZPGifzWFK0+KlZOqy0bXTcwLlB4Itd0RmN2
-oCNcd62uR37boH4sFyffCugu/01YU5nSNgh4Raav6+n9SKHhIPFwrel3Udgi5eby
-pgYEMev+PPF1X1E2qbH8j2zYTg==
------END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/17.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 23 (0x17)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta3/emailAddress=pubCA2_ta3
+        Validity
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p2_ta3/emailAddress=cs1_p2_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c6:07:89:ed:17:4d:1d:4c:e9:1f:c3:10:f8:63:
+                    50:5e:60:65:9b:13:41:07:a9:5a:b1:5e:e9:4d:6f:
+                    f7:15:b4:23:87:2b:91:c2:71:9f:4f:68:71:f3:24:
+                    a4:d6:bb:65:78:9b:8e:c5:ac:a4:1d:eb:ac:73:24:
+                    19:67:63:95:34:b3:18:56:62:0b:05:c6:4d:9e:92:
+                    cb:31:30:58:28:8e:e7:b8:f1:32:bc:cf:76:e2:22:
+                    a5:56:d2:18:a5:ec:83:65:6f:71:85:0c:62:09:a9:
+                    94:c7:ef:c9:39:a0:6f:14:0f:b3:66:36:60:95:c5:
+                    c2:f2:a6:2c:c6:00:4a:fb:6b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        8e:38:49:09:7d:23:2f:61:62:28:7c:78:5f:28:8b:1c:ba:8d:
+        cf:6d:ec:49:20:d2:17:1c:57:0e:e0:b4:c9:0b:75:d6:9c:41:
+        61:f0:60:69:1c:81:2c:0e:58:4c:2b:6c:65:51:0f:63:ab:61:
+        90:d2:99:7b:45:26:a3:68:18:da:b9:28:5c:15:6e:f1:9b:ac:
+        cf:06:93:b5:00:33:aa:8c:a0:5d:45:5c:6a:e3:61:78:b8:1a:
+        5b:bc:77:47:e6:36:58:b4:8e:16:01:4d:9a:2b:b3:8b:77:3c:
+        fd:14:4b:c6:ee:9d:cf:15:71:ad:9f:c8:b1:e5:16:68:aa:cd:
+        11:47
+-----BEGIN CERTIFICATE-----
+MIICgjCCAeugAwIBAgIBFzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EyX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0EyX3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDJfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczFfcDJfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGB4nt
+F00dTOkfwxD4Y1BeYGWbE0EHqVqxXulNb/cVtCOHK5HCcZ9PaHHzJKTWu2V4m47F
+rKQd66xzJBlnY5U0sxhWYgsFxk2ekssxMFgojue48TK8z3biIqVW0hil7INlb3GF
+DGIJqZTH78k5oG8UD7NmNmCVxcLypizGAEr7awIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQCOOEkJfSMvYWIo
+fHhfKIscuo3PbexJINIXHFcO4LTJC3XWnEFh8GBpHIEsDlhMK2xlUQ9jq2GQ0pl7
+RSajaBjauShcFW7xm6zPBpO1ADOqjKBdRVxq42F4uBpbvHdH5jZYtI4WAU2aK7OL
+dzz9FEvG7p3PFXGtn8ix5RZoqs0RRw==
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/18.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,56 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 24 (0x18)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
-        Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta4/emailAddress=cs1_ta4
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:ac:00:6d:f7:7a:86:bb:cf:c8:06:9a:71:7f:69:
-                    3a:41:2d:5d:d5:66:31:a1:2f:9d:7b:72:df:21:44:
-                    be:03:63:cd:3e:2b:fc:e3:46:8d:df:54:cb:71:27:
-                    26:cf:63:f8:9b:9f:73:5e:45:9f:b9:5e:78:5a:ed:
-                    e6:c0:22:dd:9b:dd:8a:5a:4e:bc:af:dd:70:a5:1c:
-                    12:60:1c:7a:71:7c:65:8f:41:e0:5a:fb:c7:02:9a:
-                    e1:ef:e1:d5:ab:31:fb:08:c8:f9:c9:d8:f1:7e:75:
-                    59:79:27:26:0d:21:43:89:3a:67:ad:13:74:23:fa:
-                    27:0f:b7:1a:68:65:67:b9:03
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 CRL Distribution Points: 
-                URI:http://localhost:12001/file/0/pubCA1_ta4_crl.pem
-
-    Signature Algorithm: sha256WithRSAEncryption
-        26:89:7c:81:2d:20:13:0e:c3:0c:76:39:1f:9a:65:db:66:ac:
-        75:75:cc:a3:23:8d:d7:37:b1:dd:91:5f:80:1a:46:79:6c:9a:
-        9f:c3:36:84:0e:46:6c:26:48:f1:63:67:d5:fd:f9:de:e6:52:
-        8f:a5:f1:3f:f6:06:ad:4d:4d:09:c2:64:21:ef:69:72:5c:bd:
-        f7:be:95:8a:ad:e6:6f:a8:31:83:45:04:08:a1:37:ac:4f:d4:
-        46:08:00:03:55:02:96:f8:f9:d7:db:06:94:fc:6a:06:65:a5:
-        b3:52:b9:8a:cd:01:2c:f4:48:4c:b7:e3:16:23:0c:db:42:9c:
-        e8:62
------BEGIN CERTIFICATE-----
-MIICrzCCAhigAwIBAgIBGDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNDAeFw0xMDA4MDQyMDU5MjhaFw0xMzA0MzAyMDU5MjhaMHAxCzAJBgNV
-BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
-MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczFfdGE0MRYwFAYJKoZIhvcNAQkB
-FgdjczFfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsAG33eoa7z8gG
-mnF/aTpBLV3VZjGhL517ct8hRL4DY80+K/zjRo3fVMtxJybPY/ibn3NeRZ+5Xnha
-7ebAIt2b3YpaTryv3XClHBJgHHpxfGWPQeBa+8cCmuHv4dWrMfsIyPnJ2PF+dVl5
-JyYNIUOJOmetE3Qj+icPtxpoZWe5AwIDAQABo1MwUTAMBgNVHRMBAf8EAjAAMEEG
-A1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmlsZS8wL3B1
-YkNBMV90YTRfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQAmiXyBLSATDsMMdjkf
-mmXbZqx1dcyjI43XN7HdkV+AGkZ5bJqfwzaEDkZsJkjxY2fV/fne5lKPpfE/9gat
-TU0JwmQh72lyXL33vpWKreZvqDGDRQQIoTesT9RGCAADVQKW+PnX2waU/GoGZaWz
-UrmKzQEs9EhMt+MWIwzbQpzoYg==
------END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/19.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/19.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -3,65 +3,52 @@
         Version: 3 (0x2)
         Serial Number: 25 (0x19)
         Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA3_ta3/emailAddress=pubCA3_ta3
         Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs2_ta4/emailAddress=cs2_ta4
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p3_ta3/emailAddress=cs1_p3_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:d3:11:f2:56:c0:36:ef:ad:7f:18:53:a7:29:77:
-                    9f:6a:82:43:cd:a6:65:0c:5e:ca:39:d9:fa:83:b2:
-                    0d:24:e5:10:ae:85:c5:dc:02:aa:a6:38:4f:31:f3:
-                    b6:ab:47:37:9b:f8:99:80:6c:d3:35:36:81:72:f1:
-                    93:0f:6b:dd:ca:d7:5d:a1:6a:30:74:6e:07:9c:47:
-                    c3:35:69:fc:38:e6:b5:3d:bc:65:e6:ad:67:ea:22:
-                    90:06:d3:eb:aa:64:2f:3e:b3:4c:e1:a4:65:14:8e:
-                    b2:96:85:fc:3c:1d:01:a5:4a:16:1a:b2:84:e9:a8:
-                    03:d1:09:be:7b:3c:3b:0e:ed
+                    00:d6:d5:e1:f4:de:f3:97:61:e0:be:91:78:5f:65:
+                    f1:be:e1:60:cd:6d:77:93:49:f4:72:d7:18:6c:3c:
+                    94:6a:a4:e8:fe:d5:48:70:f2:6b:ef:bf:e1:18:ab:
+                    2f:93:8a:0a:7f:4d:47:61:46:08:9b:bd:2d:31:a2:
+                    b0:0e:0b:77:76:01:77:68:9f:c5:6e:ab:6c:6c:07:
+                    2e:62:01:39:ef:43:8e:34:0b:dd:cb:47:ad:58:48:
+                    bb:1c:a8:df:db:ef:b4:1b:77:15:59:95:e6:14:2a:
+                    de:98:c7:79:58:e2:77:f7:f4:f4:08:79:21:99:16:
+                    5a:5e:43:b0:3e:98:af:28:01
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                5A:AE:AB:13:F4:60:55:35:31:96:FF:3F:20:AD:22:DF:EE:C7:4E:D3
-            X509v3 Authority Key Identifier: 
-                keyid:EE:8D:78:53:11:FE:07:CB:C8:55:4B:EF:A6:2F:E1:83:72:BB:BA:21
-                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:17
-
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 CRL Distribution Points: 
-                URI:http://localhost:12001/file/0/example_file
-
+            X509v3 Key Usage: critical
+                Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        4d:74:90:ac:a2:9c:93:39:0c:41:a7:c1:2b:73:56:97:14:32:
-        8d:64:01:78:82:a1:6f:a6:9c:3d:f5:75:80:3e:e2:b5:6c:cf:
-        c8:f2:21:46:05:e2:30:da:ce:41:88:96:87:ac:7b:a6:42:2a:
-        96:f7:1e:8d:4c:92:43:97:8f:99:08:29:47:ce:95:fb:7a:4e:
-        84:2c:0b:80:4b:c9:bf:a1:dc:0b:63:c6:9c:4f:c4:59:12:39:
-        e5:97:ee:6b:6e:86:33:18:43:da:16:5e:51:24:d0:0d:05:92:
-        7d:12:89:cd:21:fc:4e:52:86:9a:02:f9:5e:51:38:62:55:33:
-        d3:db
+        ae:c7:65:5a:78:09:d1:18:b1:ed:5e:2f:3b:7e:41:1f:93:b6:
+        43:7e:33:ab:43:cc:bd:5c:05:ae:b2:51:cc:28:db:22:aa:b5:
+        4c:35:90:09:4f:64:c0:62:04:83:fd:cd:7b:81:61:2e:63:0b:
+        0b:94:f1:b3:c0:d9:a9:91:e9:2a:df:f8:fb:02:01:6f:90:49:
+        15:0e:ac:54:21:5b:e8:9a:37:2f:d3:67:6a:90:21:e5:0d:4b:
+        e2:b9:3e:21:c4:a9:5e:f6:91:57:53:77:ae:8e:01:e8:d2:3f:
+        52:fe:27:e9:56:36:eb:91:5e:63:03:8c:51:b7:c1:0e:78:3b:
+        54:38
 -----BEGIN CERTIFICATE-----
-MIIDYDCCAsmgAwIBAgIBGTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBGTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNDAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMHAxCzAJBgNV
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EzX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0EzX3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
-MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczJfdGE0MRYwFAYJKoZIhvcNAQkB
-FgdjczJfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTEfJWwDbvrX8Y
-U6cpd59qgkPNpmUMXso52fqDsg0k5RCuhcXcAqqmOE8x87arRzeb+JmAbNM1NoFy
-8ZMPa93K112hajB0bgecR8M1afw45rU9vGXmrWfqIpAG0+uqZC8+s0zhpGUUjrKW
-hfw8HQGlShYasoTpqAPRCb57PDsO7QIDAQABo4IBAjCB/zAdBgNVHQ4EFgQUWq6r
-E/RgVTUxlv8/IK0i3+7HTtMwgZIGA1UdIwSBijCBh4AU7o14UxH+B8vIVUvvpi/h
-g3K7uiGhbKRqMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMw
-EQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQx
-EjAQBgkqhkiG9w0BCQEWA3RhNIIBFzAMBgNVHRMBAf8EAjAAMDsGA1UdHwQ0MDIw
-MKAuoCyGKmh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmlsZS8wL2V4YW1wbGVfZmls
-ZTANBgkqhkiG9w0BAQsFAAOBgQBNdJCsopyTOQxBp8Erc1aXFDKNZAF4gqFvppw9
-9XWAPuK1bM/I8iFGBeIw2s5BiJaHrHumQiqW9x6NTJJDl4+ZCClHzpX7ek6ELAuA
-S8m/odwLY8acT8RZEjnll+5rboYzGEPaFl5RJNANBZJ9EonNIfxOUoaaAvleUThi
-VTPT2w==
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDNfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczFfcDNfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDW1eH0
+3vOXYeC+kXhfZfG+4WDNbXeTSfRy1xhsPJRqpOj+1Uhw8mvvv+EYqy+Tigp/TUdh
+RgibvS0xorAOC3d2AXdon8Vuq2xsBy5iATnvQ440C93LR61YSLscqN/b77QbdxVZ
+leYUKt6Yx3lY4nf39PQIeSGZFlpeQ7A+mK8oAQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQCux2VaeAnRGLHt
+Xi87fkEfk7ZDfjOrQ8y9XAWuslHMKNsiqrVMNZAJT2TAYgSD/c17gWEuYwsLlPGz
+wNmpkekq3/j7AgFvkEkVDqxUIVvomjcv02dqkCHlDUviuT4hxKle9pFXU3eujgHo
+0j9S/ifpVjbrkV5jA4xRt8EOeDtUOA==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/1A.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,66 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 26 (0x1a)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
-        Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs3_ta4/emailAddress=cs3_ta4
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:b2:66:56:2e:29:80:41:b1:f4:0f:03:7d:94:35:
-                    7d:67:5f:a6:df:49:c8:47:d8:53:03:0b:97:bb:01:
-                    fb:ba:86:6e:5b:f1:f6:b2:50:fd:c6:4a:8f:16:0d:
-                    4c:6b:95:72:55:a1:26:c1:db:8a:f1:16:e5:06:45:
-                    72:78:5c:54:fa:4b:3e:b2:e9:68:a9:68:4f:c8:19:
-                    8d:40:c1:07:3b:82:b5:ea:60:7c:8f:94:9f:27:81:
-                    79:1e:03:f1:ac:90:42:6b:6f:87:1e:ea:b9:a8:c5:
-                    b1:a4:2a:ff:8c:1c:37:aa:7d:eb:7c:70:2a:5f:e6:
-                    56:60:84:46:e5:a2:3b:11:79
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                98:85:12:48:CD:F8:29:DD:17:72:03:5C:40:02:E6:50:F6:24:E7:2D
-            X509v3 Authority Key Identifier: 
-                keyid:EE:8D:78:53:11:FE:07:CB:C8:55:4B:EF:A6:2F:E1:83:72:BB:BA:21
-                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:17
-
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 CRL Distribution Points: 
-                URI:foo://bar/baz
-
-    Signature Algorithm: sha256WithRSAEncryption
-        49:ac:6c:a5:ab:c6:c7:ad:f3:93:47:d4:74:7f:4a:d3:46:b0:
-        71:6f:6e:42:e2:7f:f6:ed:db:38:ed:29:09:e1:e0:a0:a7:4c:
-        ec:17:56:a8:71:71:20:2a:da:f0:19:4d:e2:13:3c:6e:db:6a:
-        16:3a:46:63:15:7b:3c:a2:70:f1:6c:14:35:5b:51:80:1c:7e:
-        2c:93:23:ac:31:46:ea:7a:cf:8a:80:b9:45:95:67:ea:b7:c1:
-        cf:b7:0d:99:7b:72:37:29:4d:b3:a0:31:94:e4:55:79:9d:f2:
-        fa:18:c3:f5:fe:77:93:91:17:f1:ce:b7:ae:39:00:b1:5b:98:
-        ab:81
------BEGIN CERTIFICATE-----
-MIIDQjCCAqugAwIBAgIBGjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNDAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMHAxCzAJBgNV
-BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
-MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczNfdGE0MRYwFAYJKoZIhvcNAQkB
-FgdjczNfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyZlYuKYBBsfQP
-A32UNX1nX6bfSchH2FMDC5e7Afu6hm5b8fayUP3GSo8WDUxrlXJVoSbB24rxFuUG
-RXJ4XFT6Sz6y6WipaE/IGY1AwQc7grXqYHyPlJ8ngXkeA/GskEJrb4ce6rmoxbGk
-Kv+MHDeqfet8cCpf5lZghEblojsReQIDAQABo4HlMIHiMB0GA1UdDgQWBBSYhRJI
-zfgp3RdyA1xAAuZQ9iTnLTCBkgYDVR0jBIGKMIGHgBTujXhTEf4Hy8hVS++mL+GD
-cru6IaFspGowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzAR
-BgNVBAcTCk1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDDAKBgNVBAMTA3RhNDES
-MBAGCSqGSIb3DQEJARYDdGE0ggEXMAwGA1UdEwEB/wQCMAAwHgYDVR0fBBcwFTAT
-oBGgD4YNZm9vOi8vYmFyL2JhejANBgkqhkiG9w0BAQsFAAOBgQBJrGylq8bHrfOT
-R9R0f0rTRrBxb25C4n/27ds47SkJ4eCgp0zsF1aocXEgKtrwGU3iEzxu22oWOkZj
-FXs8onDxbBQ1W1GAHH4skyOsMUbqes+KgLlFlWfqt8HPtw2Ze3I3KU2zoDGU5FV5
-nfL6GMP1/neTkRfxzreuOQCxW5irgQ==
------END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/1B.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 27 (0x1b)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA4_ta3/emailAddress=pubCA4_ta3
+        Validity
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p4_ta3/emailAddress=cs1_p4_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c8:26:36:d7:20:0b:17:ac:dc:e5:21:93:5f:12:
+                    cc:69:bc:3a:38:c8:78:8a:8c:f9:a8:6a:f3:25:ca:
+                    24:ec:71:78:ea:52:45:15:c8:8c:96:0b:95:02:ed:
+                    46:80:43:76:fd:e0:45:c8:34:26:ac:cd:c0:63:e7:
+                    d0:87:29:24:1a:d6:05:94:88:6d:0b:cd:1a:eb:c4:
+                    bf:5f:6f:01:d5:ab:a6:cf:01:61:aa:e9:77:93:f5:
+                    9f:a1:78:7e:e0:5e:99:e0:c8:c8:cb:6b:7e:55:ab:
+                    1b:a2:87:a0:d6:27:2d:3e:e1:f9:56:4a:c4:ca:cc:
+                    41:f1:6a:59:cd:23:c4:93:13
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        6d:63:cd:fa:b7:a9:1e:6b:2f:31:e5:a5:84:4b:97:f2:ed:33:
+        21:a8:99:64:fe:72:97:a6:5e:a2:83:8c:20:fe:56:bc:6b:a5:
+        63:39:dd:6d:d7:c6:8c:0e:2c:9a:fb:ad:06:b8:be:6e:bd:f1:
+        54:02:ad:92:c8:52:23:ea:47:53:c3:9a:87:ff:62:56:d9:9e:
+        3b:6b:90:c9:e2:8c:e2:bc:f0:5c:25:b6:cd:a0:e2:cd:23:45:
+        e3:b3:21:ad:ee:69:8b:fd:5a:8d:9f:89:29:59:e4:03:ff:be:
+        2f:e5:97:4c:bc:ee:8e:e4:a3:bb:48:6c:25:ed:2f:b3:92:f3:
+        39:80
+-----BEGIN CERTIFICATE-----
+MIICgjCCAeugAwIBAgIBGzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0E0X3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0E0X3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDRfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczFfcDRfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIJjbX
+IAsXrNzlIZNfEsxpvDo4yHiKjPmoavMlyiTscXjqUkUVyIyWC5UC7UaAQ3b94EXI
+NCaszcBj59CHKSQa1gWUiG0LzRrrxL9fbwHVq6bPAWGq6XeT9Z+heH7gXpngyMjL
+a35Vqxuih6DWJy0+4flWSsTKzEHxalnNI8STEwIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBtY836t6keay8x
+5aWES5fy7TMhqJlk/nKXpl6ig4wg/la8a6VjOd1t18aMDiya+60GuL5uvfFUAq2S
+yFIj6kdTw5qH/2JW2Z47a5DJ4ozivPBcJbbNoOLNI0XjsyGt7mmL/VqNn4kpWeQD
+/74v5ZdMvO6O5KO7SGwl7S+zkvM5gA==
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/1C.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,54 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 28 (0x1c)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta5/emailAddress=pubCA1_ta5
-        Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta5/emailAddress=cs1_ta5
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:a7:58:5a:64:49:1e:65:e8:63:d7:6c:d2:b4:65:
-                    73:47:16:10:1b:a9:45:7e:22:fe:87:7b:30:58:2e:
-                    81:7f:d0:69:be:49:06:c5:44:2b:8d:32:0c:91:8f:
-                    48:d4:d9:e4:51:25:52:56:bc:40:92:a8:05:e7:65:
-                    82:c4:79:49:ac:42:fc:d4:41:71:9c:cb:7a:f0:5f:
-                    35:d7:08:11:03:3b:d3:4b:c1:cb:37:7a:cd:58:64:
-                    ec:1b:83:25:3e:3a:f3:99:23:e0:13:c5:85:9a:1a:
-                    d4:79:53:d2:32:4c:c9:50:3b:19:66:6f:22:fc:c8:
-                    5a:6b:ef:97:d9:77:01:3a:a3
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:FALSE
-            X509v3 Key Usage: 
-                Digital Signature
-    Signature Algorithm: sha256WithRSAEncryption
-        38:eb:26:f5:12:ed:5c:37:ad:86:d2:0f:b8:7e:a2:87:88:35:
-        b2:c3:50:92:41:65:48:b3:fe:fd:a6:81:a5:bc:07:70:d6:54:
-        3a:e5:dd:a9:c6:0a:fe:5d:5f:2b:97:0b:4c:5d:d0:59:9d:76:
-        95:9a:7c:d8:fa:4a:59:6c:16:27:b6:91:b2:98:8d:fe:15:23:
-        18:f0:79:0b:9c:f3:35:bb:a7:e1:31:b3:03:83:e9:3a:b1:f6:
-        1f:c2:f9:15:85:c6:0f:3d:b4:78:a4:20:e4:46:96:43:85:7c:
-        9e:ad:e0:8e:78:47:3d:f9:7b:2e:14:90:45:39:68:d4:34:fc:
-        f3:c2
------BEGIN CERTIFICATE-----
-MIICeTCCAeKgAwIBAgIBHDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNTEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNTAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMHAxCzAJBgNV
-BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
-MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczFfdGE1MRYwFAYJKoZIhvcNAQkB
-FgdjczFfdGE1MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnWFpkSR5l6GPX
-bNK0ZXNHFhAbqUV+Iv6HezBYLoF/0Gm+SQbFRCuNMgyRj0jU2eRRJVJWvECSqAXn
-ZYLEeUmsQvzUQXGcy3rwXzXXCBEDO9NLwcs3es1YZOwbgyU+OvOZI+ATxYWaGtR5
-U9IyTMlQOxlmbyL8yFpr75fZdwE6owIDAQABox0wGzAMBgNVHRMBAf8EAjAAMAsG
-A1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQA46yb1Eu1cN62G0g+4fqKHiDWy
-w1CSQWVIs/79poGlvAdw1lQ65d2pxgr+XV8rlwtMXdBZnXaVmnzY+kpZbBYntpGy
-mI3+FSMY8HkLnPM1u6fhMbMDg+k6sfYfwvkVhcYPPbR4pCDkRpZDhXyereCOeEc9
-+XsuFJBFOWjUNPzzwg==
------END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/1D.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 29 (0x1d)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA5_ta3/emailAddress=pubCA5_ta3
+        Validity
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p5_ta3/emailAddress=cs1_p5_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b3:b9:bc:52:49:6a:cc:8f:ca:8e:6d:1e:40:87:
+                    3a:c6:c9:00:0b:93:e1:76:45:27:3e:d2:8c:db:2c:
+                    06:35:f3:06:df:4b:e9:63:3e:0e:62:2d:9c:86:6f:
+                    05:a3:90:6e:4e:b2:89:c7:c5:60:7a:8f:f0:7a:f8:
+                    53:31:fe:e4:c3:e4:ae:09:67:4a:15:f5:ae:97:a1:
+                    6c:1f:ec:0a:99:ea:25:4f:a7:fe:f8:e0:55:e1:23:
+                    ba:65:08:3b:42:ac:c6:b1:30:b5:c5:ed:10:5b:3e:
+                    06:d0:63:fb:da:d2:39:e0:fa:b6:17:ac:cb:c0:ed:
+                    ae:54:cf:f9:73:e4:e8:e4:2d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        26:bd:71:87:c8:bb:70:76:91:0f:7a:68:e5:4b:2c:80:ba:73:
+        7c:65:30:b5:16:4f:7a:0a:27:17:90:bc:74:c5:6a:c4:ab:3c:
+        3c:78:f5:87:ad:cf:68:1a:4e:1d:10:34:3f:b7:a5:18:d9:d3:
+        f7:79:82:7d:16:08:77:d0:20:2c:cd:a1:2d:95:be:fb:d3:64:
+        d4:07:b3:3f:51:a4:6f:77:dc:c3:a9:3a:f9:bc:10:49:80:5a:
+        f6:2e:d1:c3:34:40:05:6a:65:7a:40:08:4a:e5:32:f3:de:0d:
+        87:7e:cf:fd:8b:a4:9d:2c:28:9c:ee:9d:f4:45:a4:9c:c6:0c:
+        d0:25
+-----BEGIN CERTIFICATE-----
+MIICgjCCAeugAwIBAgIBHTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0E1X3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0E1X3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDVfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczFfcDVfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzubxS
+SWrMj8qObR5AhzrGyQALk+F2RSc+0ozbLAY18wbfS+ljPg5iLZyGbwWjkG5OsonH
+xWB6j/B6+FMx/uTD5K4JZ0oV9a6XoWwf7AqZ6iVPp/744FXhI7plCDtCrMaxMLXF
+7RBbPgbQY/va0jng+rYXrMvA7a5Uz/lz5OjkLQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAmvXGHyLtwdpEP
+emjlSyyAunN8ZTC1Fk96CicXkLx0xWrEqzw8ePWHrc9oGk4dEDQ/t6UY2dP3eYJ9
+Fgh30CAszaEtlb7702TUB7M/UaRvd9zDqTr5vBBJgFr2LtHDNEAFamV6QAhK5TLz
+3g2Hfs/9i6SdLCic7p30RaScxgzQJQ==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/1F.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,56 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 31 (0x1f)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
+        Validity
+            Not Before: Jan 28 02:54:22 2011 GMT
+            Not After : Oct 24 02:54:22 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta4/emailAddress=cs1_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:95:55:70:3f:0a:52:f5:90:a0:00:22:11:4d:bf:
+                    05:f7:8b:55:2d:8a:1e:66:41:7f:4c:bd:55:09:d3:
+                    ba:67:0a:c8:80:36:85:a9:90:b2:d3:95:e5:e7:2a:
+                    f6:91:b6:b3:3c:81:ef:1c:0c:fb:85:91:51:0a:74:
+                    05:97:9d:25:17:be:fe:0d:8c:b4:84:37:74:0a:b0:
+                    e0:f6:74:20:7d:2c:b1:3b:c0:0e:3f:fc:9c:05:26:
+                    be:0f:41:23:ff:d9:1d:a3:5d:08:f0:33:de:43:d3:
+                    d2:e5:f1:00:3d:aa:c2:24:cd:4f:35:cc:d1:9b:5b:
+                    e1:e0:61:11:93:26:e1:ba:ef
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 CRL Distribution Points: 
+                URI:http://localhost:12001/file/0/pubCA1_ta4_crl.pem
+
+    Signature Algorithm: sha256WithRSAEncryption
+        45:36:7b:d8:11:49:e9:43:46:59:2a:a4:46:1f:43:37:1e:88:
+        7c:f6:35:f4:e3:b0:a5:8d:cf:77:80:94:84:01:5a:13:9d:1f:
+        84:d5:81:e1:9d:fd:8a:ef:ca:41:f2:df:9c:6f:d5:04:29:e6:
+        55:ab:0b:5c:40:88:a4:8e:d2:48:4b:12:d7:03:91:ec:75:4b:
+        40:b0:37:dd:8c:66:32:36:9c:1e:9d:56:6b:d3:40:91:ca:89:
+        1f:1f:3e:f9:71:e3:d6:d8:fe:09:34:03:dd:b5:3e:e8:66:be:
+        88:a4:3b:94:25:b5:a9:a8:49:d1:bb:44:1a:d3:40:d6:01:d3:
+        1f:58
+-----BEGIN CERTIFICATE-----
+MIICrzCCAhigAwIBAgIBHzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhNDAeFw0xMTAxMjgwMjU0MjJaFw0xMzEwMjQwMjU0MjJaMHAxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczFfdGE0MRYwFAYJKoZIhvcNAQkB
+FgdjczFfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVVXA/ClL1kKAA
+IhFNvwX3i1Utih5mQX9MvVUJ07pnCsiANoWpkLLTleXnKvaRtrM8ge8cDPuFkVEK
+dAWXnSUXvv4NjLSEN3QKsOD2dCB9LLE7wA4//JwFJr4PQSP/2R2jXQjwM95D09Ll
+8QA9qsIkzU81zNGbW+HgYRGTJuG67wIDAQABo1MwUTAMBgNVHRMBAf8EAjAAMEEG
+A1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmlsZS8wL3B1
+YkNBMV90YTRfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQBFNnvYEUnpQ0ZZKqRG
+H0M3Hoh89jX047Cljc93gJSEAVoTnR+E1YHhnf2K78pB8t+cb9UEKeZVqwtcQIik
+jtJISxLXA5HsdUtAsDfdjGYyNpwenVZr00CRyokfHz75cePW2P4JNAPdtT7oZr6I
+pDuUJbWpqEnRu0Qa00DWAdMfWA==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/20.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,67 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 32 (0x20)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
+        Validity
+            Not Before: Jan 28 02:54:23 2011 GMT
+            Not After : Oct 24 02:54:23 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs2_ta4/emailAddress=cs2_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:97:56:b9:2f:de:53:80:7f:22:c6:a7:29:ce:40:
+                    5e:85:76:ad:87:36:38:f2:31:66:99:32:e0:34:2e:
+                    bd:10:a9:26:f5:1e:dc:27:6e:57:4e:9d:37:1b:ad:
+                    14:d2:ba:60:44:2c:13:b2:fc:61:25:33:6f:a9:9e:
+                    d4:4a:52:28:16:51:3d:6c:3a:f1:43:80:6b:c1:69:
+                    d7:71:3a:6e:f7:04:8a:ae:2e:95:70:2a:fc:f0:25:
+                    50:9d:c6:bd:04:4b:89:1c:ae:22:83:cb:45:2e:d3:
+                    7b:74:c4:92:77:ff:bf:5b:a9:73:99:16:30:c9:26:
+                    c2:16:b9:c2:63:93:e6:5b:a7
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                55:DA:B0:E8:E1:F8:5F:D8:68:15:30:36:72:6A:69:CF:9D:A5:F3:FC
+            X509v3 Authority Key Identifier: 
+                keyid:D3:DE:A8:63:F4:5C:5D:8E:DD:53:9F:D7:9E:90:14:71:D1:21:88:4B
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
+                serial:1E
+
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 CRL Distribution Points: 
+                URI:http://localhost:12001/file/0/example_file
+
+    Signature Algorithm: sha256WithRSAEncryption
+        a4:03:ef:02:5d:84:d8:d3:87:f1:57:35:ae:ec:f1:10:22:4c:
+        26:35:fc:8c:25:c3:2e:e6:5b:0c:46:1a:bf:19:8f:af:b4:f3:
+        ad:3e:f0:e2:f5:86:6e:67:fa:d7:9e:d3:db:27:64:df:a5:90:
+        5f:b7:65:8a:47:8a:76:fb:7c:d9:3d:d3:39:17:bc:cc:d6:fc:
+        43:d3:9a:db:8d:10:35:56:7d:88:0e:2c:e8:37:fd:dd:2a:bc:
+        de:79:9e:e2:04:d5:7f:93:fb:1f:e2:de:ca:66:27:10:c5:ea:
+        b2:41:1b:c0:55:04:37:aa:52:65:9c:d1:cd:39:04:e6:6c:45:
+        e0:18
+-----BEGIN CERTIFICATE-----
+MIIDYDCCAsmgAwIBAgIBIDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhNDAeFw0xMTAxMjgwMjU0MjNaFw0xMzEwMjQwMjU0MjNaMHAxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczJfdGE0MRYwFAYJKoZIhvcNAQkB
+FgdjczJfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXVrkv3lOAfyLG
+pynOQF6Fdq2HNjjyMWaZMuA0Lr0QqSb1HtwnbldOnTcbrRTSumBELBOy/GElM2+p
+ntRKUigWUT1sOvFDgGvBaddxOm73BIquLpVwKvzwJVCdxr0ES4kcriKDy0Uu03t0
+xJJ3/79bqXOZFjDJJsIWucJjk+ZbpwIDAQABo4IBAjCB/zAdBgNVHQ4EFgQUVdqw
+6OH4X9hoFTA2cmppz52l8/wwgZIGA1UdIwSBijCBh4AU096oY/RcXY7dU5/XnpAU
+cdEhiEuhbKRqMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMw
+EQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQx
+EjAQBgkqhkiG9w0BCQEWA3RhNIIBHjAMBgNVHRMBAf8EAjAAMDsGA1UdHwQ0MDIw
+MKAuoCyGKmh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmlsZS8wL2V4YW1wbGVfZmls
+ZTANBgkqhkiG9w0BAQsFAAOBgQCkA+8CXYTY04fxVzWu7PEQIkwmNfyMJcMu5lsM
+Rhq/GY+vtPOtPvDi9YZuZ/rXntPbJ2TfpZBft2WKR4p2+3zZPdM5F7zM1vxD05rb
+jRA1Vn2IDizoN/3dKrzeeZ7iBNV/k/sf4t7KZicQxeqyQRvAVQQ3qlJlnNHNOQTm
+bEXgGA==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/21.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,66 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 33 (0x21)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
+        Validity
+            Not Before: Jan 28 02:54:24 2011 GMT
+            Not After : Oct 24 02:54:24 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs3_ta4/emailAddress=cs3_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:df:30:e0:c4:9f:26:44:f8:b3:84:3f:7a:f8:a9:
+                    76:a5:47:03:03:2f:c9:56:78:95:3c:0a:57:da:06:
+                    2d:45:bf:fd:b3:72:5c:e9:89:44:c7:cd:4e:de:a1:
+                    c7:02:33:c2:26:4e:06:34:77:62:5e:85:2f:79:e9:
+                    9b:91:de:c2:24:dc:b7:7c:b3:9d:fe:41:66:26:6c:
+                    8f:37:31:d1:43:ee:ec:8b:ba:b8:86:38:7a:9d:79:
+                    65:ac:f6:ca:fe:a8:ff:36:6a:7c:46:54:80:b7:90:
+                    82:fd:87:85:ac:1a:9a:0d:81:2f:f8:fb:4d:d3:72:
+                    a3:86:5a:85:0f:21:a2:94:b9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                11:88:8F:A2:52:4A:58:E7:DF:84:EC:BF:D8:4F:8B:88:81:5A:A4:B0
+            X509v3 Authority Key Identifier: 
+                keyid:D3:DE:A8:63:F4:5C:5D:8E:DD:53:9F:D7:9E:90:14:71:D1:21:88:4B
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
+                serial:1E
+
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 CRL Distribution Points: 
+                URI:foo://bar/baz
+
+    Signature Algorithm: sha256WithRSAEncryption
+        ac:a1:4c:cc:d5:75:ae:d4:85:75:01:b3:f6:a0:88:d0:48:25:
+        1b:ca:76:6e:2c:69:df:da:1e:53:89:4e:ed:31:64:a9:a5:96:
+        25:63:15:a1:f5:49:fa:a7:21:5e:8d:84:82:75:74:31:0b:24:
+        03:2d:c0:96:66:f8:40:fb:a4:ca:de:44:1a:a7:ab:08:27:ea:
+        f5:eb:a6:fe:34:a8:8b:61:95:53:51:e7:01:3d:ba:a9:93:be:
+        49:71:11:0d:dd:02:b7:97:15:ff:e6:8d:98:58:0d:fb:4d:5c:
+        e0:28:db:8e:34:3c:40:14:85:84:2d:38:24:56:2d:5c:5f:ac:
+        64:a9
+-----BEGIN CERTIFICATE-----
+MIIDQjCCAqugAwIBAgIBITANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhNDAeFw0xMTAxMjgwMjU0MjRaFw0xMzEwMjQwMjU0MjRaMHAxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczNfdGE0MRYwFAYJKoZIhvcNAQkB
+FgdjczNfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfMODEnyZE+LOE
+P3r4qXalRwMDL8lWeJU8ClfaBi1Fv/2zclzpiUTHzU7eoccCM8ImTgY0d2JehS95
+6ZuR3sIk3Ld8s53+QWYmbI83MdFD7uyLuriGOHqdeWWs9sr+qP82anxGVIC3kIL9
+h4WsGpoNgS/4+03TcqOGWoUPIaKUuQIDAQABo4HlMIHiMB0GA1UdDgQWBBQRiI+i
+UkpY59+E7L/YT4uIgVqksDCBkgYDVR0jBIGKMIGHgBTT3qhj9Fxdjt1Tn9eekBRx
+0SGIS6FspGowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzAR
+BgNVBAcTCk1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDDAKBgNVBAMTA3RhNDES
+MBAGCSqGSIb3DQEJARYDdGE0ggEeMAwGA1UdEwEB/wQCMAAwHgYDVR0fBBcwFTAT
+oBGgD4YNZm9vOi8vYmFyL2JhejANBgkqhkiG9w0BAQsFAAOBgQCsoUzM1XWu1IV1
+AbP2oIjQSCUbynZuLGnf2h5TiU7tMWSppZYlYxWh9Un6pyFejYSCdXQxCyQDLcCW
+ZvhA+6TK3kQap6sIJ+r166b+NKiLYZVTUecBPbqpk75JcREN3QK3lxX/5o2YWA37
+TVzgKNuONDxAFIWELTgkVi1cX6xkqQ==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/23.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,56 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 35 (0x23)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta4/emailAddress=pubCA2_ta4
+        Validity
+            Not Before: Jan 28 02:54:24 2011 GMT
+            Not After : Oct 24 02:54:24 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p2_ta4/emailAddress=cs1_p2_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:cb:fa:59:73:5c:67:c6:f3:3a:0a:79:d9:b8:9d:
+                    cd:6e:e5:bf:29:79:9f:d7:a0:1f:60:aa:bb:88:5e:
+                    55:07:ae:9e:5e:7e:4c:f1:3a:25:1b:72:62:81:44:
+                    2b:94:60:2f:24:37:b1:25:72:4f:14:e3:a5:38:ec:
+                    c5:8f:54:d4:e1:90:71:43:86:dc:d1:a9:a2:84:b3:
+                    a8:be:e2:ee:ce:57:69:29:e5:69:ac:cd:45:f3:e9:
+                    1a:b3:38:f2:a5:e0:a0:8e:d8:0c:05:0a:bf:5e:d8:
+                    22:67:60:08:10:ce:37:cb:46:b2:77:fd:56:08:7c:
+                    62:d8:fc:5d:69:a6:e6:df:e3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 CRL Distribution Points: 
+                URI:http://localhost:12001/file/0/pubCA2_ta4_crl.pem
+
+    Signature Algorithm: sha256WithRSAEncryption
+        40:b2:b7:46:97:8c:3b:a8:c8:df:59:13:af:2c:a6:59:93:f2:
+        d4:28:6f:bf:b1:3f:ac:7b:9d:f6:a8:29:be:15:1a:53:8d:86:
+        35:44:25:4b:b5:59:ea:54:07:5c:91:9b:a5:9b:94:a6:de:dc:
+        51:be:58:8d:cb:07:fe:1a:1a:1a:12:a5:b3:84:75:f5:9c:83:
+        5f:25:4b:d1:81:31:bb:74:d0:fc:92:41:d4:d2:63:b1:0b:96:
+        3c:da:b1:0b:1a:f6:6c:96:68:3b:36:6a:33:7c:c3:40:1b:7e:
+        4b:e5:dc:88:b4:25:2b:fe:0c:23:df:84:43:28:7c:39:d6:11:
+        22:23
+-----BEGIN CERTIFICATE-----
+MIICtTCCAh6gAwIBAgIBIzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EyX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0EyX3RhNDAeFw0xMTAxMjgwMjU0MjRaFw0xMzEwMjQwMjU0MjRaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDJfdGE0MRkwFwYJKoZIhvcN
+AQkBFgpjczFfcDJfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDL+llz
+XGfG8zoKedm4nc1u5b8peZ/XoB9gqruIXlUHrp5efkzxOiUbcmKBRCuUYC8kN7El
+ck8U46U47MWPVNThkHFDhtzRqaKEs6i+4u7OV2kp5WmszUXz6RqzOPKl4KCO2AwF
+Cr9e2CJnYAgQzjfLRrJ3/VYIfGLY/F1ppubf4wIDAQABo1MwUTAMBgNVHRMBAf8E
+AjAAMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmls
+ZS8wL3B1YkNBMl90YTRfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQBAsrdGl4w7
+qMjfWROvLKZZk/LUKG+/sT+se532qCm+FRpTjYY1RCVLtVnqVAdckZulm5Sm3txR
+vliNywf+GhoaEqWzhHX1nINfJUvRgTG7dND8kkHU0mOxC5Y82rELGvZslmg7Nmoz
+fMNAG35L5dyItCUr/gwj34RDKHw51hEiIw==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/25.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 37 (0x25)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta5/emailAddress=pubCA1_ta5
+        Validity
+            Not Before: Jan 28 02:54:25 2011 GMT
+            Not After : Oct 24 02:54:25 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta5/emailAddress=cs1_ta5
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c4:23:9b:a5:a6:bb:de:48:a0:b4:2e:2d:54:4f:
+                    e7:61:e4:9d:df:ad:01:7e:70:55:12:35:36:d4:71:
+                    e5:1f:fe:00:d9:0f:1b:de:62:57:2c:d7:46:67:28:
+                    67:84:c7:b3:c3:99:6a:ec:89:c1:e9:d2:60:a8:48:
+                    d1:06:c9:68:c9:87:d6:82:88:aa:4c:33:d6:60:a4:
+                    bb:2b:38:0d:e8:11:ae:73:4c:b7:29:39:24:55:3d:
+                    c2:64:b0:54:e8:8d:67:1f:79:94:8d:6f:4c:95:cd:
+                    d6:00:9f:cb:f6:90:bd:07:52:f1:fe:16:b2:25:0e:
+                    49:40:c0:cf:66:3c:9d:78:89
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        86:7e:5b:75:75:be:0f:f3:ba:dd:6c:2c:db:1b:70:e1:3c:30:
+        37:7b:86:54:ad:5a:01:cc:64:e5:c2:67:c8:75:53:7d:65:80:
+        0b:0a:b5:8c:71:e5:42:25:fc:5a:48:6e:e2:5c:ef:19:fe:c1:
+        02:01:16:a7:f0:07:bc:ed:62:3f:2e:b0:7f:c3:73:27:c6:92:
+        69:36:ef:90:fd:1a:f6:7d:f6:5a:98:be:c8:63:da:65:e2:41:
+        3a:0a:4b:40:b2:a7:90:8e:96:d6:8d:d5:4d:a8:a5:60:89:b0:
+        96:d6:c6:cf:d3:3e:8f:0d:4c:34:c9:e8:af:65:d8:6d:fe:ed:
+        88:d1
+-----BEGIN CERTIFICATE-----
+MIICfDCCAeWgAwIBAgIBJTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNTEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhNTAeFw0xMTAxMjgwMjU0MjVaFw0xMzEwMjQwMjU0MjVaMHAxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczFfdGE1MRYwFAYJKoZIhvcNAQkB
+FgdjczFfdGE1MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEI5ulprveSKC0
+Li1UT+dh5J3frQF+cFUSNTbUceUf/gDZDxveYlcs10ZnKGeEx7PDmWrsicHp0mCo
+SNEGyWjJh9aCiKpMM9ZgpLsrOA3oEa5zTLcpOSRVPcJksFTojWcfeZSNb0yVzdYA
+n8v2kL0HUvH+FrIlDklAwM9mPJ14iQIDAQABoyAwHjAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQCGflt1db4P87rdbCzbG3Dh
+PDA3e4ZUrVoBzGTlwmfIdVN9ZYALCrWMceVCJfxaSG7iXO8Z/sECARan8Ae87WI/
+LrB/w3MnxpJpNu+Q/Rr2ffZamL7IY9pl4kE6CktAsqeQjpbWjdVNqKVgibCW1sbP
+0z6PDUw0yeivZdht/u2I0Q==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_cs8_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 21 (0x15)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs8_p1_ta3/emailAddress=cs8_p1_ta3
+        Validity
+            Not Before: Jan 28 02:54:20 2011 GMT
+            Not After : Oct 24 02:54:20 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_cs8_p1_ta3/emailAddress=cs1_cs8_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b7:b3:67:af:2e:4f:cd:e6:84:61:80:0a:6a:0d:
+                    d7:48:3e:34:76:b9:51:d4:47:4c:20:d1:cb:29:f3:
+                    cb:30:f9:de:be:4c:dd:3b:7c:8b:ad:2a:b8:90:49:
+                    f1:e5:e0:93:e9:c4:72:41:b7:c7:1e:ad:fb:6c:84:
+                    51:3f:b6:58:cc:15:7a:cf:3c:16:fa:e1:29:2e:57:
+                    90:90:5b:d1:55:a6:0c:76:6a:85:6c:19:71:0b:33:
+                    cc:93:bb:4e:02:59:d0:08:dc:cb:8c:17:1f:40:de:
+                    fb:ba:b5:24:e0:f0:b3:df:b1:94:d1:7b:80:d9:74:
+                    a9:44:4e:b7:eb:cd:cf:62:ed
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        7f:59:dd:b6:d7:6a:bf:e7:c2:c0:53:9c:8f:90:e3:e5:3a:75:
+        04:35:ef:d8:39:f9:53:e6:1e:bf:8b:fd:c3:19:21:81:70:09:
+        a1:e6:89:6f:9d:3c:f3:9c:c5:00:5b:0c:7d:e3:13:de:cf:1b:
+        10:2b:ab:c3:d2:77:76:03:59:ef:43:39:a9:de:78:e9:a9:a1:
+        fb:8b:b4:c7:ec:37:97:5b:65:ee:af:e4:66:c7:42:a8:24:73:
+        d2:3f:37:fc:9f:79:93:53:88:81:0b:f6:be:f7:ac:f8:9d:37:
+        c8:c6:66:81:2e:f0:8a:0e:41:95:24:9d:4c:90:50:94:51:45:
+        46:8f
+-----BEGIN CERTIFICATE-----
+MIICijCCAfOgAwIBAgIBFTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKY3M4X3AxX3RhMzEZMBcGCSqGSIb3DQEJARYKY3M4
+X3AxX3RhMzAeFw0xMTAxMjgwMjU0MjBaFw0xMzEwMjQwMjU0MjBaMH4xCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRcwFQYDVQQDFA5jczFfY3M4X3AxX3RhMzEdMBsGCSqG
+SIb3DQEJARYOY3MxX2NzOF9wMV90YTMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBALezZ68uT83mhGGACmoN10g+NHa5UdRHTCDRyynzyzD53r5M3Tt8i60quJBJ
+8eXgk+nEckG3xx6t+2yEUT+2WMwVes88FvrhKS5XkJBb0VWmDHZqhWwZcQszzJO7
+TgJZ0Ajcy4wXH0De+7q1JODws9+xlNF7gNl0qUROt+vNz2LtAgMBAAGjIDAeMAwG
+A1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4GBAH9Z
+3bbXar/nwsBTnI+Q4+U6dQQ179g5+VPmHr+L/cMZIYFwCaHmiW+dPPOcxQBbDH3j
+E97PGxArq8PSd3YDWe9DOaneeOmpofuLtMfsN5dbZe6v5GbHQqgkc9I/N/yfeZNT
+iIEL9r73rPidN8jGZoEu8IoOQZUknUyQUJRRRUaP
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p1_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,50 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p1_ta3/emailAddress=cs1_p1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:dd:8e:8a:e1:5f:20:65:74:0d:91:f3:d6:bd:76:
-                    67:58:99:ae:d7:99:bc:78:1f:d0:bb:d9:97:95:41:
-                    3b:42:4b:cc:cc:36:d8:27:00:2a:c3:27:92:4c:2d:
-                    5f:62:81:0c:b2:6d:1b:93:ca:a4:1c:18:09:8c:26:
-                    22:bf:80:a4:fe:48:37:87:64:63:32:95:41:8f:f6:
-                    35:98:93:f0:61:f2:4b:eb:b0:34:36:67:85:a1:9d:
-                    21:75:de:ab:9f:32:ae:3a:93:64:48:7f:ef:5a:fa:
-                    44:e2:1b:9f:9d:10:3c:c3:9c:90:dd:e1:fe:33:31:
-                    4a:22:cb:82:ab:84:2a:1e:af
+                    00:f6:03:62:59:9b:4b:42:80:bd:9e:2c:51:9d:d6:
+                    d3:5b:3e:36:b3:da:4b:05:ed:d1:77:b7:3e:dc:0a:
+                    87:20:89:51:84:e5:f9:f0:9d:fe:1d:e9:ad:ca:43:
+                    9d:41:8e:84:7d:eb:36:85:4f:14:da:18:ee:c9:c3:
+                    e7:f2:cd:9c:c4:11:16:52:d7:07:9f:f5:52:b7:7b:
+                    66:d5:ae:10:0f:fc:44:6d:a4:89:60:95:85:12:ca:
+                    31:34:26:1b:b5:e6:4f:5b:31:cc:76:76:c3:12:29:
+                    f6:64:b6:ea:44:da:e9:51:15:d6:1d:5a:91:cb:62:
+                    6e:da:c7:25:66:2f:30:52:17
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        3c:c2:d6:d7:6b:2a:e4:79:6d:b3:c8:48:64:b6:54:0c:30:d0:
-        3b:cd:4e:b8:f8:cd:0a:94:53:e5:10:b9:9e:93:f3:5a:a5:5e:
-        8c:4f:a6:d9:6c:98:ac:b6:e9:87:5e:85:ca:80:7f:34:5f:8a:
-        97:7a:f3:fc:8e:8d:de:6c:58:02:dc:ee:46:96:46:38:60:13:
-        7d:3a:5e:b8:32:e9:15:33:3f:0f:f2:21:2c:ea:ef:cf:0b:ff:
-        b8:07:58:2a:61:15:2c:fe:69:86:02:78:76:60:ce:51:30:8a:
-        26:ed:aa:9e:ee:b0:64:81:2f:0f:5c:a5:cd:47:cd:59:0b:3b:
-        aa:12
+        5e:5b:97:12:03:fe:8e:f1:93:90:83:b4:65:f5:4b:56:f6:69:
+        44:d7:12:f3:e7:56:bc:5f:f6:ae:5c:95:19:39:0f:0f:77:0f:
+        ef:78:bf:49:df:98:bb:91:02:3d:94:5e:90:d6:b0:a2:b0:d2:
+        db:70:29:01:d6:39:81:a5:c3:30:9c:b7:95:21:c7:13:36:9e:
+        f7:36:c5:be:7e:f4:9d:3b:71:2d:da:d9:07:55:67:62:34:33:
+        01:19:a7:ba:6f:ae:98:0e:22:a4:06:ad:16:ea:33:7f:e2:15:
+        83:4d:ac:ab:55:ff:aa:2b:15:a6:d2:73:e4:a4:43:53:6c:35:
+        9a:33
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBDTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBDTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMzAeFw0xMDA4MDQyMDU5MjVaFw0xMzA0MzAyMDU5MjVaMHYxCzAJBgNV
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTNaFw0xMzEwMjQwMjU0MTNaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDdjorh
-XyBldA2R89a9dmdYma7Xmbx4H9C72ZeVQTtCS8zMNtgnACrDJ5JMLV9igQyybRuT
-yqQcGAmMJiK/gKT+SDeHZGMylUGP9jWYk/Bh8kvrsDQ2Z4WhnSF13qufMq46k2RI
-f+9a+kTiG5+dEDzDnJDd4f4zMUoiy4KrhCoerwIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQA8wtbXayrkeW2zyEhk
-tlQMMNA7zU64+M0KlFPlELmek/NapV6MT6bZbJistumHXoXKgH80X4qXevP8jo3e
-bFgC3O5GlkY4YBN9Ol64MukVMz8P8iEs6u/PC/+4B1gqYRUs/mmGAnh2YM5RMIom
-7aqe7rBkgS8PXKXNR81ZCzuqEg==
+AQkBFgpjczFfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2A2JZ
+m0tCgL2eLFGd1tNbPjaz2ksF7dF3tz7cCocgiVGE5fnwnf4d6a3KQ51BjoR96zaF
+TxTaGO7Jw+fyzZzEERZS1wef9VK3e2bVrhAP/ERtpIlglYUSyjE0Jhu15k9bMcx2
+dsMSKfZktupE2ulRFdYdWpHLYm7axyVmLzBSFwIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBeW5cSA/6O8ZOQ
+g7Rl9UtW9mlE1xLz51a8X/auXJUZOQ8Pdw/veL9J35i7kQI9lF6Q1rCisNLbcCkB
+1jmBpcMwnLeVIccTNp73NsW+fvSdO3Et2tkHVWdiNDMBGae6b66YDiKkBq0W6jN/
+4hWDTayrVf+qKxWm0nPkpENTbDWaMw==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p2_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p2_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,54 +1,54 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 18 (0x12)
+        Serial Number: 23 (0x17)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta3/emailAddress=pubCA2_ta3
         Validity
-            Not Before: Aug  4 20:59:27 2010 GMT
-            Not After : Apr 30 20:59:27 2013 GMT
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p2_ta3/emailAddress=cs1_p2_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:d0:1e:f6:58:e2:2b:d0:15:fe:da:5c:5d:11:84:
-                    b9:7c:65:42:51:e2:92:9e:43:c0:71:c2:0b:ba:4b:
-                    07:60:14:08:27:16:f5:2c:16:44:6d:89:0e:cf:6f:
-                    47:2d:ef:12:df:0d:9d:9c:94:cf:4e:f0:00:1c:07:
-                    3b:6c:e5:10:61:97:f3:c0:20:12:6c:00:87:9d:95:
-                    e4:3b:14:de:7d:97:77:59:9a:2c:9a:f6:a9:0c:20:
-                    3f:0b:da:a9:13:32:d3:a9:a7:5f:38:9f:b5:7f:19:
-                    0f:f1:ff:c0:a6:7f:e9:76:24:66:72:29:ce:6d:6a:
-                    a2:c3:3e:34:0a:34:b8:c4:9b
+                    00:c6:07:89:ed:17:4d:1d:4c:e9:1f:c3:10:f8:63:
+                    50:5e:60:65:9b:13:41:07:a9:5a:b1:5e:e9:4d:6f:
+                    f7:15:b4:23:87:2b:91:c2:71:9f:4f:68:71:f3:24:
+                    a4:d6:bb:65:78:9b:8e:c5:ac:a4:1d:eb:ac:73:24:
+                    19:67:63:95:34:b3:18:56:62:0b:05:c6:4d:9e:92:
+                    cb:31:30:58:28:8e:e7:b8:f1:32:bc:cf:76:e2:22:
+                    a5:56:d2:18:a5:ec:83:65:6f:71:85:0c:62:09:a9:
+                    94:c7:ef:c9:39:a0:6f:14:0f:b3:66:36:60:95:c5:
+                    c2:f2:a6:2c:c6:00:4a:fb:6b
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        2f:4c:87:b3:14:32:98:dd:06:48:ce:26:54:7d:49:d7:3d:6a:
-        a3:ac:52:bc:55:9e:9f:09:82:1a:ea:cc:c3:a4:a2:83:4e:98:
-        73:cd:29:f5:0b:46:4f:f7:e6:97:cb:96:8f:60:ca:22:b0:dc:
-        37:0e:7b:89:4c:24:13:aa:9a:4e:65:f7:66:f2:3c:99:e3:12:
-        e4:59:db:b9:9f:46:a4:27:19:1b:90:f3:2b:8d:01:88:78:81:
-        34:90:0e:14:a9:80:05:f1:19:28:22:e1:00:f3:e4:a6:e1:28:
-        0d:d0:36:ac:9f:1c:05:9c:17:e3:0f:2b:40:6b:1a:7a:07:60:
-        8c:b5
+        8e:38:49:09:7d:23:2f:61:62:28:7c:78:5f:28:8b:1c:ba:8d:
+        cf:6d:ec:49:20:d2:17:1c:57:0e:e0:b4:c9:0b:75:d6:9c:41:
+        61:f0:60:69:1c:81:2c:0e:58:4c:2b:6c:65:51:0f:63:ab:61:
+        90:d2:99:7b:45:26:a3:68:18:da:b9:28:5c:15:6e:f1:9b:ac:
+        cf:06:93:b5:00:33:aa:8c:a0:5d:45:5c:6a:e3:61:78:b8:1a:
+        5b:bc:77:47:e6:36:58:b4:8e:16:01:4d:9a:2b:b3:8b:77:3c:
+        fd:14:4b:c6:ee:9d:cf:15:71:ad:9f:c8:b1:e5:16:68:aa:cd:
+        11:47
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBEjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBFzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EyX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0EyX3RhMzAeFw0xMDA4MDQyMDU5MjdaFw0xMzA0MzAyMDU5MjdaMHYxCzAJBgNV
+Q0EyX3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDJfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDJfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQHvZY
-4ivQFf7aXF0RhLl8ZUJR4pKeQ8Bxwgu6SwdgFAgnFvUsFkRtiQ7Pb0ct7xLfDZ2c
-lM9O8AAcBzts5RBhl/PAIBJsAIedleQ7FN59l3dZmiya9qkMID8L2qkTMtOpp184
-n7V/GQ/x/8Cmf+l2JGZyKc5taqLDPjQKNLjEmwIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAvTIezFDKY3QZIziZU
-fUnXPWqjrFK8VZ6fCYIa6szDpKKDTphzzSn1C0ZP9+aXy5aPYMoisNw3DnuJTCQT
-qppOZfdm8jyZ4xLkWdu5n0akJxkbkPMrjQGIeIE0kA4UqYAF8RkoIuEA8+Sm4SgN
-0DasnxwFnBfjDytAaxp6B2CMtQ==
+AQkBFgpjczFfcDJfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGB4nt
+F00dTOkfwxD4Y1BeYGWbE0EHqVqxXulNb/cVtCOHK5HCcZ9PaHHzJKTWu2V4m47F
+rKQd66xzJBlnY5U0sxhWYgsFxk2ekssxMFgojue48TK8z3biIqVW0hil7INlb3GF
+DGIJqZTH78k5oG8UD7NmNmCVxcLypizGAEr7awIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQCOOEkJfSMvYWIo
+fHhfKIscuo3PbexJINIXHFcO4LTJC3XWnEFh8GBpHIEsDlhMK2xlUQ9jq2GQ0pl7
+RSajaBjauShcFW7xm6zPBpO1ADOqjKBdRVxq42F4uBpbvHdH5jZYtI4WAU2aK7OL
+dzz9FEvG7p3PFXGtn8ix5RZoqs0RRw==
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p2_ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,56 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 35 (0x23)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta4/emailAddress=pubCA2_ta4
+        Validity
+            Not Before: Jan 28 02:54:24 2011 GMT
+            Not After : Oct 24 02:54:24 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p2_ta4/emailAddress=cs1_p2_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:cb:fa:59:73:5c:67:c6:f3:3a:0a:79:d9:b8:9d:
+                    cd:6e:e5:bf:29:79:9f:d7:a0:1f:60:aa:bb:88:5e:
+                    55:07:ae:9e:5e:7e:4c:f1:3a:25:1b:72:62:81:44:
+                    2b:94:60:2f:24:37:b1:25:72:4f:14:e3:a5:38:ec:
+                    c5:8f:54:d4:e1:90:71:43:86:dc:d1:a9:a2:84:b3:
+                    a8:be:e2:ee:ce:57:69:29:e5:69:ac:cd:45:f3:e9:
+                    1a:b3:38:f2:a5:e0:a0:8e:d8:0c:05:0a:bf:5e:d8:
+                    22:67:60:08:10:ce:37:cb:46:b2:77:fd:56:08:7c:
+                    62:d8:fc:5d:69:a6:e6:df:e3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 CRL Distribution Points: 
+                URI:http://localhost:12001/file/0/pubCA2_ta4_crl.pem
+
+    Signature Algorithm: sha256WithRSAEncryption
+        40:b2:b7:46:97:8c:3b:a8:c8:df:59:13:af:2c:a6:59:93:f2:
+        d4:28:6f:bf:b1:3f:ac:7b:9d:f6:a8:29:be:15:1a:53:8d:86:
+        35:44:25:4b:b5:59:ea:54:07:5c:91:9b:a5:9b:94:a6:de:dc:
+        51:be:58:8d:cb:07:fe:1a:1a:1a:12:a5:b3:84:75:f5:9c:83:
+        5f:25:4b:d1:81:31:bb:74:d0:fc:92:41:d4:d2:63:b1:0b:96:
+        3c:da:b1:0b:1a:f6:6c:96:68:3b:36:6a:33:7c:c3:40:1b:7e:
+        4b:e5:dc:88:b4:25:2b:fe:0c:23:df:84:43:28:7c:39:d6:11:
+        22:23
+-----BEGIN CERTIFICATE-----
+MIICtTCCAh6gAwIBAgIBIzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EyX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0EyX3RhNDAeFw0xMTAxMjgwMjU0MjRaFw0xMzEwMjQwMjU0MjRaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDJfdGE0MRkwFwYJKoZIhvcN
+AQkBFgpjczFfcDJfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDL+llz
+XGfG8zoKedm4nc1u5b8peZ/XoB9gqruIXlUHrp5efkzxOiUbcmKBRCuUYC8kN7El
+ck8U46U47MWPVNThkHFDhtzRqaKEs6i+4u7OV2kp5WmszUXz6RqzOPKl4KCO2AwF
+Cr9e2CJnYAgQzjfLRrJ3/VYIfGLY/F1ppubf4wIDAQABo1MwUTAMBgNVHRMBAf8E
+AjAAMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmls
+ZS8wL3B1YkNBMl90YTRfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQBAsrdGl4w7
+qMjfWROvLKZZk/LUKG+/sT+se532qCm+FRpTjYY1RCVLtVnqVAdckZulm5Sm3txR
+vliNywf+GhoaEqWzhHX1nINfJUvRgTG7dND8kkHU0mOxC5Y82rELGvZslmg7Nmoz
+fMNAG35L5dyItCUr/gwj34RDKHw51hEiIw==
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p3_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p3_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,54 +1,54 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 20 (0x14)
+        Serial Number: 25 (0x19)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA3_ta3/emailAddress=pubCA3_ta3
         Validity
-            Not Before: Aug  4 20:59:27 2010 GMT
-            Not After : Apr 30 20:59:27 2013 GMT
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p3_ta3/emailAddress=cs1_p3_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:bc:82:7d:df:49:1f:1f:4c:7e:ee:25:51:96:e4:
-                    49:a8:fb:ee:b0:51:b5:10:e9:cc:f0:36:07:59:61:
-                    37:a8:95:70:5f:53:3e:54:ef:02:46:d9:12:84:20:
-                    8f:65:c4:53:99:e6:cc:d9:de:d0:e5:d2:51:2b:3d:
-                    3d:08:88:a3:35:d3:7e:bf:c9:70:d3:65:81:16:30:
-                    18:0e:7f:22:66:52:05:65:d0:e4:65:11:06:8d:df:
-                    a1:97:df:74:c4:f3:be:d2:6f:ee:12:8d:1a:dd:15:
-                    b8:e4:7e:cd:12:ce:d4:47:4d:d5:e9:d7:c8:3b:e0:
-                    0a:43:7a:4a:cc:11:6a:38:31
+                    00:d6:d5:e1:f4:de:f3:97:61:e0:be:91:78:5f:65:
+                    f1:be:e1:60:cd:6d:77:93:49:f4:72:d7:18:6c:3c:
+                    94:6a:a4:e8:fe:d5:48:70:f2:6b:ef:bf:e1:18:ab:
+                    2f:93:8a:0a:7f:4d:47:61:46:08:9b:bd:2d:31:a2:
+                    b0:0e:0b:77:76:01:77:68:9f:c5:6e:ab:6c:6c:07:
+                    2e:62:01:39:ef:43:8e:34:0b:dd:cb:47:ad:58:48:
+                    bb:1c:a8:df:db:ef:b4:1b:77:15:59:95:e6:14:2a:
+                    de:98:c7:79:58:e2:77:f7:f4:f4:08:79:21:99:16:
+                    5a:5e:43:b0:3e:98:af:28:01
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        33:5c:cd:75:6d:2d:67:ce:9a:bb:c9:86:9d:07:59:66:9c:b2:
-        36:0f:a6:6d:5a:a4:dc:11:0a:b6:0a:80:78:5d:93:8a:c6:6b:
-        e1:81:01:70:31:5b:0c:ad:8e:04:35:4a:6b:c6:54:d5:28:fd:
-        8d:bb:c6:90:b2:66:58:3a:8c:a6:e5:98:dc:e5:ed:5f:ad:55:
-        48:99:68:2a:7f:5a:b4:48:e7:96:29:97:9a:af:d5:b4:be:08:
-        e9:cd:34:7f:15:98:3c:f7:30:f6:a8:ed:4b:4a:57:f5:1c:18:
-        2a:96:36:f6:ec:a0:d4:bc:50:b6:68:0f:cd:ac:44:0c:97:c5:
-        89:59
+        ae:c7:65:5a:78:09:d1:18:b1:ed:5e:2f:3b:7e:41:1f:93:b6:
+        43:7e:33:ab:43:cc:bd:5c:05:ae:b2:51:cc:28:db:22:aa:b5:
+        4c:35:90:09:4f:64:c0:62:04:83:fd:cd:7b:81:61:2e:63:0b:
+        0b:94:f1:b3:c0:d9:a9:91:e9:2a:df:f8:fb:02:01:6f:90:49:
+        15:0e:ac:54:21:5b:e8:9a:37:2f:d3:67:6a:90:21:e5:0d:4b:
+        e2:b9:3e:21:c4:a9:5e:f6:91:57:53:77:ae:8e:01:e8:d2:3f:
+        52:fe:27:e9:56:36:eb:91:5e:63:03:8c:51:b7:c1:0e:78:3b:
+        54:38
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBFDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBGTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0EzX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0EzX3RhMzAeFw0xMDA4MDQyMDU5MjdaFw0xMzA0MzAyMDU5MjdaMHYxCzAJBgNV
+Q0EzX3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDNfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDNfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8gn3f
-SR8fTH7uJVGW5Emo++6wUbUQ6czwNgdZYTeolXBfUz5U7wJG2RKEII9lxFOZ5szZ
-3tDl0lErPT0IiKM1036/yXDTZYEWMBgOfyJmUgVl0ORlEQaN36GX33TE877Sb+4S
-jRrdFbjkfs0SztRHTdXp18g74ApDekrMEWo4MQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAzXM11bS1nzpq7yYad
-B1lmnLI2D6ZtWqTcEQq2CoB4XZOKxmvhgQFwMVsMrY4ENUprxlTVKP2Nu8aQsmZY
-Ooym5Zjc5e1frVVImWgqf1q0SOeWKZear9W0vgjpzTR/FZg89zD2qO1LSlf1HBgq
-ljb27KDUvFC2aA/NrEQMl8WJWQ==
+AQkBFgpjczFfcDNfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDW1eH0
+3vOXYeC+kXhfZfG+4WDNbXeTSfRy1xhsPJRqpOj+1Uhw8mvvv+EYqy+Tigp/TUdh
+RgibvS0xorAOC3d2AXdon8Vuq2xsBy5iATnvQ440C93LR61YSLscqN/b77QbdxVZ
+leYUKt6Yx3lY4nf39PQIeSGZFlpeQ7A+mK8oAQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQCux2VaeAnRGLHt
+Xi87fkEfk7ZDfjOrQ8y9XAWuslHMKNsiqrVMNZAJT2TAYgSD/c17gWEuYwsLlPGz
+wNmpkekq3/j7AgFvkEkVDqxUIVvomjcv02dqkCHlDUviuT4hxKle9pFXU3eujgHo
+0j9S/ifpVjbrkV5jA4xRt8EOeDtUOA==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p4_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p4_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,54 +1,54 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 22 (0x16)
+        Serial Number: 27 (0x1b)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA4_ta3/emailAddress=pubCA4_ta3
         Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p4_ta3/emailAddress=cs1_p4_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:bf:42:c9:e7:65:b4:c1:88:85:cc:9a:49:29:db:
-                    64:05:14:60:b4:c4:ab:44:7d:86:51:9d:c0:ba:c2:
-                    41:c2:80:fc:e7:ea:26:14:f2:73:af:90:98:98:c8:
-                    ed:eb:89:d4:1f:a7:9a:7a:4f:8d:0a:4a:b5:54:de:
-                    3c:1a:5c:cc:18:1d:39:dd:f5:2b:97:a6:1c:b3:75:
-                    4c:da:1f:86:bb:1f:0f:67:b1:a0:e9:1c:f9:21:e0:
-                    2e:98:de:5c:64:66:7f:39:42:78:14:a5:ce:2c:b2:
-                    9b:fc:f2:54:a1:a2:af:cc:73:80:a3:6d:d0:d3:29:
-                    f9:ae:9b:e1:d6:9c:3a:19:89
+                    00:c8:26:36:d7:20:0b:17:ac:dc:e5:21:93:5f:12:
+                    cc:69:bc:3a:38:c8:78:8a:8c:f9:a8:6a:f3:25:ca:
+                    24:ec:71:78:ea:52:45:15:c8:8c:96:0b:95:02:ed:
+                    46:80:43:76:fd:e0:45:c8:34:26:ac:cd:c0:63:e7:
+                    d0:87:29:24:1a:d6:05:94:88:6d:0b:cd:1a:eb:c4:
+                    bf:5f:6f:01:d5:ab:a6:cf:01:61:aa:e9:77:93:f5:
+                    9f:a1:78:7e:e0:5e:99:e0:c8:c8:cb:6b:7e:55:ab:
+                    1b:a2:87:a0:d6:27:2d:3e:e1:f9:56:4a:c4:ca:cc:
+                    41:f1:6a:59:cd:23:c4:93:13
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        1b:81:d7:ec:0d:02:2c:b0:29:3c:62:f1:f5:e3:71:50:ac:a2:
-        d5:66:86:8c:98:c2:5a:79:2c:25:cf:a1:55:0f:4f:17:5d:93:
-        c6:89:fc:d6:14:ad:3e:2a:56:4e:ab:2d:1b:5d:37:30:2e:50:
-        78:22:d7:74:46:63:76:a0:23:5c:77:ad:ae:47:7e:db:a0:7e:
-        2c:17:27:df:0a:e8:2e:ff:4d:58:53:99:d2:36:08:78:45:a6:
-        af:eb:e9:fd:48:a1:e1:20:f1:70:ad:e9:77:51:d8:22:e5:e6:
-        f2:a6:06:04:31:eb:fe:3c:f1:75:5f:51:36:a9:b1:fc:8f:6c:
-        d8:4e
+        6d:63:cd:fa:b7:a9:1e:6b:2f:31:e5:a5:84:4b:97:f2:ed:33:
+        21:a8:99:64:fe:72:97:a6:5e:a2:83:8c:20:fe:56:bc:6b:a5:
+        63:39:dd:6d:d7:c6:8c:0e:2c:9a:fb:ad:06:b8:be:6e:bd:f1:
+        54:02:ad:92:c8:52:23:ea:47:53:c3:9a:87:ff:62:56:d9:9e:
+        3b:6b:90:c9:e2:8c:e2:bc:f0:5c:25:b6:cd:a0:e2:cd:23:45:
+        e3:b3:21:ad:ee:69:8b:fd:5a:8d:9f:89:29:59:e4:03:ff:be:
+        2f:e5:97:4c:bc:ee:8e:e4:a3:bb:48:6c:25:ed:2f:b3:92:f3:
+        39:80
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBFjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBGzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0E0X3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0E0X3RhMzAeFw0xMDA4MDQyMDU5MjhaFw0xMzA0MzAyMDU5MjhaMHYxCzAJBgNV
+Q0E0X3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDRfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcDRfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/Qsnn
-ZbTBiIXMmkkp22QFFGC0xKtEfYZRncC6wkHCgPzn6iYU8nOvkJiYyO3ridQfp5p6
-T40KSrVU3jwaXMwYHTnd9SuXphyzdUzaH4a7Hw9nsaDpHPkh4C6Y3lxkZn85QngU
-pc4sspv88lShoq/Mc4CjbdDTKfmum+HWnDoZiQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAbgdfsDQIssCk8YvH1
-43FQrKLVZoaMmMJaeSwlz6FVD08XXZPGifzWFK0+KlZOqy0bXTcwLlB4Itd0RmN2
-oCNcd62uR37boH4sFyffCugu/01YU5nSNgh4Raav6+n9SKHhIPFwrel3Udgi5eby
-pgYEMev+PPF1X1E2qbH8j2zYTg==
+AQkBFgpjczFfcDRfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDIJjbX
+IAsXrNzlIZNfEsxpvDo4yHiKjPmoavMlyiTscXjqUkUVyIyWC5UC7UaAQ3b94EXI
+NCaszcBj59CHKSQa1gWUiG0LzRrrxL9fbwHVq6bPAWGq6XeT9Z+heH7gXpngyMjL
+a35Vqxuih6DWJy0+4flWSsTKzEHxalnNI8STEwIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBtY836t6keay8x
+5aWES5fy7TMhqJlk/nKXpl6ig4wg/la8a6VjOd1t18aMDiya+60GuL5uvfFUAq2S
+yFIj6kdTw5qH/2JW2Z47a5DJ4ozivPBcJbbNoOLNI0XjsyGt7mmL/VqNn4kpWeQD
+/74v5ZdMvO6O5KO7SGwl7S+zkvM5gA==
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_p5_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 29 (0x1d)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA5_ta3/emailAddress=pubCA5_ta3
+        Validity
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_p5_ta3/emailAddress=cs1_p5_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b3:b9:bc:52:49:6a:cc:8f:ca:8e:6d:1e:40:87:
+                    3a:c6:c9:00:0b:93:e1:76:45:27:3e:d2:8c:db:2c:
+                    06:35:f3:06:df:4b:e9:63:3e:0e:62:2d:9c:86:6f:
+                    05:a3:90:6e:4e:b2:89:c7:c5:60:7a:8f:f0:7a:f8:
+                    53:31:fe:e4:c3:e4:ae:09:67:4a:15:f5:ae:97:a1:
+                    6c:1f:ec:0a:99:ea:25:4f:a7:fe:f8:e0:55:e1:23:
+                    ba:65:08:3b:42:ac:c6:b1:30:b5:c5:ed:10:5b:3e:
+                    06:d0:63:fb:da:d2:39:e0:fa:b6:17:ac:cb:c0:ed:
+                    ae:54:cf:f9:73:e4:e8:e4:2d
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        26:bd:71:87:c8:bb:70:76:91:0f:7a:68:e5:4b:2c:80:ba:73:
+        7c:65:30:b5:16:4f:7a:0a:27:17:90:bc:74:c5:6a:c4:ab:3c:
+        3c:78:f5:87:ad:cf:68:1a:4e:1d:10:34:3f:b7:a5:18:d9:d3:
+        f7:79:82:7d:16:08:77:d0:20:2c:cd:a1:2d:95:be:fb:d3:64:
+        d4:07:b3:3f:51:a4:6f:77:dc:c3:a9:3a:f9:bc:10:49:80:5a:
+        f6:2e:d1:c3:34:40:05:6a:65:7a:40:08:4a:e5:32:f3:de:0d:
+        87:7e:cf:fd:8b:a4:9d:2c:28:9c:ee:9d:f4:45:a4:9c:c6:0c:
+        d0:25
+-----BEGIN CERTIFICATE-----
+MIICgjCCAeugAwIBAgIBHTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0E1X3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0E1X3RhMzAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcDVfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczFfcDVfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzubxS
+SWrMj8qObR5AhzrGyQALk+F2RSc+0ozbLAY18wbfS+ljPg5iLZyGbwWjkG5OsonH
+xWB6j/B6+FMx/uTD5K4JZ0oV9a6XoWwf7AqZ6iVPp/744FXhI7plCDtCrMaxMLXF
+7RBbPgbQY/va0jng+rYXrMvA7a5Uz/lz5OjkLQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQAmvXGHyLtwdpEP
+emjlSyyAunN8ZTC1Fk96CicXkLx0xWrEqzw8ePWHrc9oGk4dEDQ/t6UY2dP3eYJ9
+Fgh30CAszaEtlb7702TUB7M/UaRvd9zDqTr5vBBJgFr2LtHDNEAFamV6QAhK5TLz
+3g2Hfs/9i6SdLCic7p30RaScxgzQJQ==
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_pubCA1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_pubCA1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,50 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_pubCA1/emailAddress=cs1_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:97:a7:b6:9a:40:63:12:2f:3c:4b:3f:75:d2:53:
-                    5b:c9:c9:6e:7c:fc:f6:8e:35:7f:7a:5a:b2:fa:00:
-                    eb:dd:f0:f2:87:2a:c9:9b:4d:7e:2d:3c:f1:0e:4e:
-                    ff:b4:b1:91:88:2f:c3:ab:ae:65:39:1e:da:e8:7e:
-                    50:b5:94:48:a6:5c:b0:bb:42:aa:70:e6:50:9c:41:
-                    2c:67:38:6c:e0:5d:9a:7d:b4:95:36:54:ea:e8:48:
-                    24:31:1c:30:39:24:2c:2a:1f:de:c2:c8:bf:e8:82:
-                    35:4a:9b:52:8e:15:e8:34:df:0c:78:be:e5:c6:85:
-                    c6:79:88:75:c0:04:e4:b8:77
+                    00:d6:e0:78:fd:9b:ec:79:f0:02:f0:cc:7a:8b:63:
+                    e1:60:e3:41:a8:d8:0d:82:4a:2d:ee:6c:53:b0:6b:
+                    21:50:42:06:2e:a6:af:3d:fa:e8:55:a0:79:54:31:
+                    cb:65:f8:03:e6:84:a9:3d:76:cc:7b:06:de:d3:25:
+                    0e:e5:e3:99:18:7c:13:9e:73:3d:5c:88:7a:5d:f5:
+                    58:54:08:cf:bf:fc:73:d0:ef:be:f5:04:fb:71:4b:
+                    98:84:82:3a:61:f5:04:29:48:5d:3d:c2:73:56:33:
+                    8e:0e:fc:0d:3a:1e:57:d9:a3:7c:c9:fd:db:27:8a:
+                    1a:de:d4:13:53:ce:a2:12:79
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        61:86:7f:54:cd:2f:e0:7f:2a:9a:20:55:23:af:00:79:13:25:
-        2e:29:4e:c6:40:d5:66:60:ea:34:b8:9a:cc:d9:39:04:63:d7:
-        f8:ae:a3:3d:73:54:34:8d:67:5a:92:b1:1a:f8:f0:38:f3:64:
-        2e:45:32:bd:29:a1:e3:32:d6:c7:73:77:70:c0:f0:e6:d4:00:
-        62:3b:e2:23:12:bb:f4:f7:d7:0c:15:74:2a:b0:cb:90:00:f3:
-        ba:ad:3c:15:35:4b:ef:c3:08:34:4e:02:e7:6c:bd:2c:e6:45:
-        43:fa:c5:1d:14:3c:6b:33:01:1d:22:b2:12:2e:0e:e7:82:53:
-        49:9b
+        e1:3a:ec:60:96:47:14:c0:7a:76:85:f9:54:21:ae:48:b9:d1:
+        33:a3:62:73:07:04:83:aa:4b:a7:6a:3f:a9:ff:8e:34:8c:38:
+        c0:a4:38:c2:66:75:6f:67:20:31:1d:9b:bf:a7:19:52:c5:56:
+        ff:5c:f1:a8:07:bc:66:7f:e0:49:23:18:af:fa:ca:c7:36:0b:
+        67:85:08:d3:35:61:44:ce:6b:d5:f2:92:a5:bc:98:d1:24:68:
+        3c:a9:0a:f7:71:a4:0b:41:fb:69:37:7c:78:d4:4b:18:ab:2b:
+        95:a9:19:cb:b7:01:53:65:cc:d4:22:a1:69:47:bd:e8:db:41:
+        fe:82
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBBjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBBjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gyX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gy
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczFfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjczFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXp7aa
-QGMSLzxLP3XSU1vJyW58/PaONX96WrL6AOvd8PKHKsmbTX4tPPEOTv+0sZGIL8Or
-rmU5HtroflC1lEimXLC7Qqpw5lCcQSxnOGzgXZp9tJU2VOroSCQxHDA5JCwqH97C
-yL/ogjVKm1KOFeg03wx4vuXGhcZ5iHXABOS4dwIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBhhn9UzS/gfyqaIFUj
-rwB5EyUuKU7GQNVmYOo0uJrM2TkEY9f4rqM9c1Q0jWdakrEa+PA482QuRTK9KaHj
-MtbHc3dwwPDm1ABiO+IjErv099cMFXQqsMuQAPO6rTwVNUvvwwg0TgLnbL0s5kVD
-+sUdFDxrMwEdIrISLg7nglNJmw==
+AQkBFgpjczFfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDW4Hj9
+m+x58ALwzHqLY+Fg40Go2A2CSi3ubFOwayFQQgYupq89+uhVoHlUMctl+APmhKk9
+dsx7Bt7TJQ7l45kYfBOecz1ciHpd9VhUCM+//HPQ7771BPtxS5iEgjph9QQpSF09
+wnNWM44O/A06HlfZo3zJ/dsnihre1BNTzqISeQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQDhOuxglkcUwHp2
+hflUIa5IudEzo2JzBwSDqkunaj+p/440jDjApDjCZnVvZyAxHZu/pxlSxVb/XPGo
+B7xmf+BJIxiv+srHNgtnhQjTNWFEzmvV8pKlvJjRJGg8qQr3caQLQftpN3x41EsY
+qyuVqRnLtwFTZczUIqFpR73o20H+gg==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta2_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta2_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,49 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta2/emailAddress=ta2
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta2/emailAddress=cs1_ta2
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b7:0f:a6:ed:f2:e7:d2:c1:de:09:a9:5b:7d:ba:
-                    41:14:76:aa:26:fc:f6:a5:0b:d5:42:a5:e1:f0:5b:
-                    2a:15:f0:60:b7:df:06:13:02:06:03:e3:df:31:b9:
-                    4f:60:1c:ed:04:55:28:11:bd:8b:7b:9d:98:6a:2c:
-                    18:e8:45:85:a5:8b:ce:4c:87:3e:91:46:dd:76:91:
-                    ca:d1:0d:36:02:1b:23:18:4c:44:01:a4:8e:30:01:
-                    fe:09:a8:46:28:e3:2e:e5:5f:45:66:f9:a5:81:2a:
-                    f3:97:0d:c8:ed:22:cf:59:82:4b:cc:c6:eb:14:35:
-                    48:48:df:a8:58:a4:3c:80:63
+                    00:b8:c1:19:42:b1:26:a9:33:1f:1f:55:d0:4f:6d:
+                    43:a3:55:75:c7:de:18:5a:69:cc:62:b2:a6:ec:f5:
+                    78:19:31:5a:1a:d8:6c:d8:48:66:7d:15:d4:da:fe:
+                    dd:7c:42:a0:ae:22:d1:51:f5:22:54:49:7d:16:58:
+                    cf:82:b7:3e:45:c5:7e:da:84:28:f6:b3:5c:90:61:
+                    27:0e:70:fe:fa:6c:3f:20:0a:a0:10:50:9c:75:a4:
+                    02:62:d8:68:26:63:ba:21:10:89:39:ab:18:fa:10:
+                    77:26:4f:ac:f1:50:41:fc:8c:f7:dc:e9:20:19:7c:
+                    2c:fb:02:c7:40:6d:69:ff:05
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        79:48:fb:8f:11:f5:8b:94:10:b2:09:f5:ee:de:34:e9:61:b7:
-        00:53:0b:82:99:dd:34:13:cf:de:73:54:12:af:62:24:a8:9b:
-        10:1e:04:f6:39:ac:10:20:80:70:d5:ee:29:40:00:91:ae:e5:
-        62:cf:1c:22:19:b2:bf:3a:b5:b1:b1:89:29:d7:c2:50:c6:5c:
-        1b:d8:e5:02:f1:c1:a9:f1:bc:b7:6c:37:65:2b:25:18:31:10:
-        56:73:b0:71:30:6e:2a:f5:82:31:81:75:81:05:0b:11:5e:ed:
-        28:85:0a:cc:17:1e:a0:c8:37:01:a6:75:71:9a:89:89:c9:24:
-        1e:5b
+        4b:b0:61:5b:c9:9a:81:8a:04:92:d4:98:39:fc:45:bd:34:90:
+        cc:69:4f:86:09:47:3f:e9:26:e2:a0:e6:d4:63:53:32:85:48:
+        de:1a:ef:43:bb:8d:19:29:5f:f8:13:bc:27:76:82:d2:77:6d:
+        80:68:e9:96:a3:cd:a3:d0:3c:b1:2a:94:54:7f:d9:95:61:07:
+        f7:d9:84:67:ea:bf:23:10:1a:9a:23:f7:3b:aa:83:a4:3c:18:
+        12:95:11:18:fb:2e:93:7c:84:61:6c:50:7d:67:ac:44:39:f5:
+        f2:9a:b0:89:f9:bd:71:e0:ae:bb:53:bc:ce:97:5e:ee:cd:14:
+        ad:14
 -----BEGIN CERTIFICATE-----
-MIICazCCAdSgAwIBAgIBCzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIICbjCCAdegAwIBAgIBCzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEyMRIwEAYJKoZIhvcNAQkBFgN0YTIwHhcNMTAw
-ODA0MjA1OTI1WhcNMTMwNDMwMjA1OTI1WjBwMQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEyMRIwEAYJKoZIhvcNAQkBFgN0YTIwHhcNMTEw
+MTI4MDI1NDEzWhcNMTMxMDI0MDI1NDEzWjBwMQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTEQMA4GA1UEAxQHY3MxX3RhMjEWMBQGCSqGSIb3DQEJARYHY3MxX3RhMjCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtw+m7fLn0sHeCalbfbpBFHaqJvz2pQvV
-QqXh8FsqFfBgt98GEwIGA+PfMblPYBztBFUoEb2Le52YaiwY6EWFpYvOTIc+kUbd
-dpHK0Q02AhsjGExEAaSOMAH+CahGKOMu5V9FZvmlgSrzlw3I7SLPWYJLzMbrFDVI
-SN+oWKQ8gGMCAwEAAaMdMBswDAYDVR0TAQH/BAIwADALBgNVHQ8EBAMCB4AwDQYJ
-KoZIhvcNAQELBQADgYEAeUj7jxH1i5QQsgn17t406WG3AFMLgpndNBPP3nNUEq9i
-JKibEB4E9jmsECCAcNXuKUAAka7lYs8cIhmyvzq1sbGJKdfCUMZcG9jlAvHBqfG8
-t2w3ZSslGDEQVnOwcTBuKvWCMYF1gQULEV7tKIUKzBceoMg3AaZ1cZqJickkHls=
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuMEZQrEmqTMfH1XQT21Do1V1x94YWmnM
+YrKm7PV4GTFaGths2EhmfRXU2v7dfEKgriLRUfUiVEl9FljPgrc+RcV+2oQo9rNc
+kGEnDnD++mw/IAqgEFCcdaQCYthoJmO6IRCJOasY+hB3Jk+s8VBB/Iz33OkgGXws
++wLHQG1p/wUCAwEAAaMgMB4wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4Aw
+DQYJKoZIhvcNAQELBQADgYEAS7BhW8magYoEktSYOfxFvTSQzGlPhglHP+km4qDm
+1GNTMoVI3hrvQ7uNGSlf+BO8J3aC0ndtgGjplqPNo9A8sSqUVH/ZlWEH99mEZ+q/
+IxAamiP3O6qDpDwYEpURGPsuk3yEYWxQfWesRDn18pqwifm9ceCuu1O8zpde7s0U
+rRQ=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta4_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,26 +1,26 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 24 (0x18)
+        Serial Number: 31 (0x1f)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
         Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
+            Not Before: Jan 28 02:54:22 2011 GMT
+            Not After : Oct 24 02:54:22 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta4/emailAddress=cs1_ta4
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:ac:00:6d:f7:7a:86:bb:cf:c8:06:9a:71:7f:69:
-                    3a:41:2d:5d:d5:66:31:a1:2f:9d:7b:72:df:21:44:
-                    be:03:63:cd:3e:2b:fc:e3:46:8d:df:54:cb:71:27:
-                    26:cf:63:f8:9b:9f:73:5e:45:9f:b9:5e:78:5a:ed:
-                    e6:c0:22:dd:9b:dd:8a:5a:4e:bc:af:dd:70:a5:1c:
-                    12:60:1c:7a:71:7c:65:8f:41:e0:5a:fb:c7:02:9a:
-                    e1:ef:e1:d5:ab:31:fb:08:c8:f9:c9:d8:f1:7e:75:
-                    59:79:27:26:0d:21:43:89:3a:67:ad:13:74:23:fa:
-                    27:0f:b7:1a:68:65:67:b9:03
+                    00:95:55:70:3f:0a:52:f5:90:a0:00:22:11:4d:bf:
+                    05:f7:8b:55:2d:8a:1e:66:41:7f:4c:bd:55:09:d3:
+                    ba:67:0a:c8:80:36:85:a9:90:b2:d3:95:e5:e7:2a:
+                    f6:91:b6:b3:3c:81:ef:1c:0c:fb:85:91:51:0a:74:
+                    05:97:9d:25:17:be:fe:0d:8c:b4:84:37:74:0a:b0:
+                    e0:f6:74:20:7d:2c:b1:3b:c0:0e:3f:fc:9c:05:26:
+                    be:0f:41:23:ff:d9:1d:a3:5d:08:f0:33:de:43:d3:
+                    d2:e5:f1:00:3d:aa:c2:24:cd:4f:35:cc:d1:9b:5b:
+                    e1:e0:61:11:93:26:e1:ba:ef
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,28 +29,28 @@
                 URI:http://localhost:12001/file/0/pubCA1_ta4_crl.pem
 
     Signature Algorithm: sha256WithRSAEncryption
-        26:89:7c:81:2d:20:13:0e:c3:0c:76:39:1f:9a:65:db:66:ac:
-        75:75:cc:a3:23:8d:d7:37:b1:dd:91:5f:80:1a:46:79:6c:9a:
-        9f:c3:36:84:0e:46:6c:26:48:f1:63:67:d5:fd:f9:de:e6:52:
-        8f:a5:f1:3f:f6:06:ad:4d:4d:09:c2:64:21:ef:69:72:5c:bd:
-        f7:be:95:8a:ad:e6:6f:a8:31:83:45:04:08:a1:37:ac:4f:d4:
-        46:08:00:03:55:02:96:f8:f9:d7:db:06:94:fc:6a:06:65:a5:
-        b3:52:b9:8a:cd:01:2c:f4:48:4c:b7:e3:16:23:0c:db:42:9c:
-        e8:62
+        45:36:7b:d8:11:49:e9:43:46:59:2a:a4:46:1f:43:37:1e:88:
+        7c:f6:35:f4:e3:b0:a5:8d:cf:77:80:94:84:01:5a:13:9d:1f:
+        84:d5:81:e1:9d:fd:8a:ef:ca:41:f2:df:9c:6f:d5:04:29:e6:
+        55:ab:0b:5c:40:88:a4:8e:d2:48:4b:12:d7:03:91:ec:75:4b:
+        40:b0:37:dd:8c:66:32:36:9c:1e:9d:56:6b:d3:40:91:ca:89:
+        1f:1f:3e:f9:71:e3:d6:d8:fe:09:34:03:dd:b5:3e:e8:66:be:
+        88:a4:3b:94:25:b5:a9:a8:49:d1:bb:44:1a:d3:40:d6:01:d3:
+        1f:58
 -----BEGIN CERTIFICATE-----
-MIICrzCCAhigAwIBAgIBGDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICrzCCAhigAwIBAgIBHzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNDAeFw0xMDA4MDQyMDU5MjhaFw0xMzA0MzAyMDU5MjhaMHAxCzAJBgNV
+Q0ExX3RhNDAeFw0xMTAxMjgwMjU0MjJaFw0xMzEwMjQwMjU0MjJaMHAxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczFfdGE0MRYwFAYJKoZIhvcNAQkB
-FgdjczFfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCsAG33eoa7z8gG
-mnF/aTpBLV3VZjGhL517ct8hRL4DY80+K/zjRo3fVMtxJybPY/ibn3NeRZ+5Xnha
-7ebAIt2b3YpaTryv3XClHBJgHHpxfGWPQeBa+8cCmuHv4dWrMfsIyPnJ2PF+dVl5
-JyYNIUOJOmetE3Qj+icPtxpoZWe5AwIDAQABo1MwUTAMBgNVHRMBAf8EAjAAMEEG
+FgdjczFfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVVXA/ClL1kKAA
+IhFNvwX3i1Utih5mQX9MvVUJ07pnCsiANoWpkLLTleXnKvaRtrM8ge8cDPuFkVEK
+dAWXnSUXvv4NjLSEN3QKsOD2dCB9LLE7wA4//JwFJr4PQSP/2R2jXQjwM95D09Ll
+8QA9qsIkzU81zNGbW+HgYRGTJuG67wIDAQABo1MwUTAMBgNVHRMBAf8EAjAAMEEG
 A1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmlsZS8wL3B1
-YkNBMV90YTRfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQAmiXyBLSATDsMMdjkf
-mmXbZqx1dcyjI43XN7HdkV+AGkZ5bJqfwzaEDkZsJkjxY2fV/fne5lKPpfE/9gat
-TU0JwmQh72lyXL33vpWKreZvqDGDRQQIoTesT9RGCAADVQKW+PnX2waU/GoGZaWz
-UrmKzQEs9EhMt+MWIwzbQpzoYg==
+YkNBMV90YTRfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQBFNnvYEUnpQ0ZZKqRG
+H0M3Hoh89jX047Cljc93gJSEAVoTnR+E1YHhnf2K78pB8t+cb9UEKeZVqwtcQIik
+jtJISxLXA5HsdUtAsDfdjGYyNpwenVZr00CRyokfHz75cePW2P4JNAPdtT7oZr6I
+pDuUJbWpqEnRu0Qa00DWAdMfWA==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta5_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs1_ta5_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,54 +1,54 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 28 (0x1c)
+        Serial Number: 37 (0x25)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta5/emailAddress=pubCA1_ta5
         Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
+            Not Before: Jan 28 02:54:25 2011 GMT
+            Not After : Oct 24 02:54:25 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs1_ta5/emailAddress=cs1_ta5
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:a7:58:5a:64:49:1e:65:e8:63:d7:6c:d2:b4:65:
-                    73:47:16:10:1b:a9:45:7e:22:fe:87:7b:30:58:2e:
-                    81:7f:d0:69:be:49:06:c5:44:2b:8d:32:0c:91:8f:
-                    48:d4:d9:e4:51:25:52:56:bc:40:92:a8:05:e7:65:
-                    82:c4:79:49:ac:42:fc:d4:41:71:9c:cb:7a:f0:5f:
-                    35:d7:08:11:03:3b:d3:4b:c1:cb:37:7a:cd:58:64:
-                    ec:1b:83:25:3e:3a:f3:99:23:e0:13:c5:85:9a:1a:
-                    d4:79:53:d2:32:4c:c9:50:3b:19:66:6f:22:fc:c8:
-                    5a:6b:ef:97:d9:77:01:3a:a3
+                    00:c4:23:9b:a5:a6:bb:de:48:a0:b4:2e:2d:54:4f:
+                    e7:61:e4:9d:df:ad:01:7e:70:55:12:35:36:d4:71:
+                    e5:1f:fe:00:d9:0f:1b:de:62:57:2c:d7:46:67:28:
+                    67:84:c7:b3:c3:99:6a:ec:89:c1:e9:d2:60:a8:48:
+                    d1:06:c9:68:c9:87:d6:82:88:aa:4c:33:d6:60:a4:
+                    bb:2b:38:0d:e8:11:ae:73:4c:b7:29:39:24:55:3d:
+                    c2:64:b0:54:e8:8d:67:1f:79:94:8d:6f:4c:95:cd:
+                    d6:00:9f:cb:f6:90:bd:07:52:f1:fe:16:b2:25:0e:
+                    49:40:c0:cf:66:3c:9d:78:89
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        38:eb:26:f5:12:ed:5c:37:ad:86:d2:0f:b8:7e:a2:87:88:35:
-        b2:c3:50:92:41:65:48:b3:fe:fd:a6:81:a5:bc:07:70:d6:54:
-        3a:e5:dd:a9:c6:0a:fe:5d:5f:2b:97:0b:4c:5d:d0:59:9d:76:
-        95:9a:7c:d8:fa:4a:59:6c:16:27:b6:91:b2:98:8d:fe:15:23:
-        18:f0:79:0b:9c:f3:35:bb:a7:e1:31:b3:03:83:e9:3a:b1:f6:
-        1f:c2:f9:15:85:c6:0f:3d:b4:78:a4:20:e4:46:96:43:85:7c:
-        9e:ad:e0:8e:78:47:3d:f9:7b:2e:14:90:45:39:68:d4:34:fc:
-        f3:c2
+        86:7e:5b:75:75:be:0f:f3:ba:dd:6c:2c:db:1b:70:e1:3c:30:
+        37:7b:86:54:ad:5a:01:cc:64:e5:c2:67:c8:75:53:7d:65:80:
+        0b:0a:b5:8c:71:e5:42:25:fc:5a:48:6e:e2:5c:ef:19:fe:c1:
+        02:01:16:a7:f0:07:bc:ed:62:3f:2e:b0:7f:c3:73:27:c6:92:
+        69:36:ef:90:fd:1a:f6:7d:f6:5a:98:be:c8:63:da:65:e2:41:
+        3a:0a:4b:40:b2:a7:90:8e:96:d6:8d:d5:4d:a8:a5:60:89:b0:
+        96:d6:c6:cf:d3:3e:8f:0d:4c:34:c9:e8:af:65:d8:6d:fe:ed:
+        88:d1
 -----BEGIN CERTIFICATE-----
-MIICeTCCAeKgAwIBAgIBHDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICfDCCAeWgAwIBAgIBJTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNTEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNTAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMHAxCzAJBgNV
+Q0ExX3RhNTAeFw0xMTAxMjgwMjU0MjVaFw0xMzEwMjQwMjU0MjVaMHAxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczFfdGE1MRYwFAYJKoZIhvcNAQkB
-FgdjczFfdGE1MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnWFpkSR5l6GPX
-bNK0ZXNHFhAbqUV+Iv6HezBYLoF/0Gm+SQbFRCuNMgyRj0jU2eRRJVJWvECSqAXn
-ZYLEeUmsQvzUQXGcy3rwXzXXCBEDO9NLwcs3es1YZOwbgyU+OvOZI+ATxYWaGtR5
-U9IyTMlQOxlmbyL8yFpr75fZdwE6owIDAQABox0wGzAMBgNVHRMBAf8EAjAAMAsG
-A1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQA46yb1Eu1cN62G0g+4fqKHiDWy
-w1CSQWVIs/79poGlvAdw1lQ65d2pxgr+XV8rlwtMXdBZnXaVmnzY+kpZbBYntpGy
-mI3+FSMY8HkLnPM1u6fhMbMDg+k6sfYfwvkVhcYPPbR4pCDkRpZDhXyereCOeEc9
-+XsuFJBFOWjUNPzzwg==
+FgdjczFfdGE1MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEI5ulprveSKC0
+Li1UT+dh5J3frQF+cFUSNTbUceUf/gDZDxveYlcs10ZnKGeEx7PDmWrsicHp0mCo
+SNEGyWjJh9aCiKpMM9ZgpLsrOA3oEa5zTLcpOSRVPcJksFTojWcfeZSNb0yVzdYA
+n8v2kL0HUvH+FrIlDklAwM9mPJ14iQIDAQABoyAwHjAMBgNVHRMBAf8EAjAAMA4G
+A1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQCGflt1db4P87rdbCzbG3Dh
+PDA3e4ZUrVoBzGTlwmfIdVN9ZYALCrWMceVCJfxaSG7iXO8Z/sECARan8Ae87WI/
+LrB/w3MnxpJpNu+Q/Rr2ffZamL7IY9pl4kE6CktAsqeQjpbWjdVNqKVgibCW1sbP
+0z6PDUw0yeivZdht/u2I0Q==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_p1_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Validity
-            Not Before: Aug  4 20:59:26 2010 GMT
-            Not After : Apr 30 20:59:26 2013 GMT
+            Not Before: Jan 28 02:54:18 2011 GMT
+            Not After : Oct 24 02:54:18 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs2_p1_ta3/emailAddress=cs2_p1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:c4:33:d5:18:cf:f2:82:d5:e6:c0:68:5a:3a:2a:
-                    50:30:fc:d6:df:61:cc:c1:35:16:cd:22:bf:72:42:
-                    2a:08:aa:93:f8:52:18:e9:e4:45:f3:d1:0a:a2:38:
-                    c6:44:73:e1:27:84:98:88:2f:f8:b2:b1:e2:46:39:
-                    bd:1f:cf:7a:bc:51:7f:31:e4:f5:b8:56:f3:54:4c:
-                    a5:57:ae:70:cc:f6:a4:46:8b:2c:7e:d3:6f:9b:c2:
-                    bb:e6:a4:f2:2a:15:e1:48:54:2c:63:fd:b3:eb:9e:
-                    6d:3a:bd:cc:3d:ce:3d:16:52:c1:6b:2a:82:8c:ca:
-                    60:50:6d:d6:aa:88:e7:c5:29
+                    00:bd:d7:4b:2b:72:c6:0b:98:3b:3d:ec:72:3f:64:
+                    78:bf:a2:c5:47:c1:20:2c:2c:b4:e5:0e:2c:be:aa:
+                    7c:ec:9f:ea:ec:06:24:fa:e3:0d:64:ce:4c:59:84:
+                    4c:c9:65:40:1f:d0:74:de:1b:90:49:ab:70:22:b7:
+                    9b:ae:13:98:df:66:44:b4:2c:82:8b:c8:43:54:c0:
+                    e3:bf:71:61:5a:96:4f:ef:86:f7:e0:d6:84:5d:81:
+                    40:0f:1d:d5:25:98:fb:19:52:4b:40:39:3e:2a:d2:
+                    2f:f6:15:7f:94:19:19:44:d7:85:c4:b5:9e:2a:e2:
+                    e3:ca:8d:a4:8f:84:22:b8:0d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,27 +29,27 @@
                 <EMPTY>
 
     Signature Algorithm: sha256WithRSAEncryption
-        04:c7:86:2b:af:5e:8c:eb:fc:5f:b4:ab:40:f2:57:b4:2c:db:
-        bc:14:6c:9c:49:5c:79:c9:55:a2:6b:ff:2a:d0:98:d7:66:83:
-        cc:48:58:f1:e8:a8:14:17:80:bc:18:bd:cf:d4:f9:02:a1:44:
-        6d:7c:91:f9:3c:97:03:28:2c:9e:c6:14:a9:8d:3a:bd:c7:c4:
-        ef:93:df:62:b5:41:2b:63:ed:16:a6:de:f2:f7:ab:54:b9:04:
-        b6:8f:ba:25:45:76:89:51:b2:c3:bc:67:db:78:93:3d:ae:77:
-        b2:0c:26:14:be:9e:89:ed:bb:f6:df:a4:b4:61:b1:18:bf:b8:
-        e6:38
+        12:18:e4:2e:db:dc:d1:db:98:c7:15:88:5e:10:47:9d:89:55:
+        b8:43:44:2b:30:ff:ca:b9:19:74:ff:f3:05:c3:60:bb:f9:3a:
+        5e:61:41:da:a3:03:59:cd:ae:39:d0:0b:83:e3:df:19:e5:1a:
+        92:79:09:d6:6d:e4:00:4c:32:45:cf:7f:3e:bc:96:c6:2e:7d:
+        80:d5:ae:11:c6:3d:4c:81:bb:97:39:9f:55:74:36:d5:19:63:
+        ea:25:43:bc:8e:ab:88:86:e7:53:8f:e8:30:9a:51:3e:f1:6f:
+        a2:21:43:b5:c8:d8:0b:84:65:a8:d5:06:55:f4:38:b9:35:90:
+        ee:47
 -----BEGIN CERTIFICATE-----
 MIICgDCCAemgAwIBAgIBDjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMzAeFw0xMDA4MDQyMDU5MjZaFw0xMzA0MzAyMDU5MjZaMHYxCzAJBgNV
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MThaFw0xMzEwMjQwMjU0MThaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczJfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczJfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDEM9UY
-z/KC1ebAaFo6KlAw/NbfYczBNRbNIr9yQioIqpP4Uhjp5EXz0QqiOMZEc+EnhJiI
-L/iyseJGOb0fz3q8UX8x5PW4VvNUTKVXrnDM9qRGiyx+02+bwrvmpPIqFeFIVCxj
-/bPrnm06vcw9zj0WUsFrKoKMymBQbdaqiOfFKQIDAQABox4wHDAMBgNVHRMBAf8E
-AjAAMAwGA1UdEgEB/wQCMAAwDQYJKoZIhvcNAQELBQADgYEABMeGK69ejOv8X7Sr
-QPJXtCzbvBRsnElceclVomv/KtCY12aDzEhY8eioFBeAvBi9z9T5AqFEbXyR+TyX
-AygsnsYUqY06vcfE75PfYrVBK2PtFqbe8verVLkEto+6JUV2iVGyw7xn23iTPa53
-sgwmFL6eie279t+ktGGxGL+45jg=
+AQkBFgpjczJfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC910sr
+csYLmDs97HI/ZHi/osVHwSAsLLTlDiy+qnzsn+rsBiT64w1kzkxZhEzJZUAf0HTe
+G5BJq3Ait5uuE5jfZkS0LIKLyENUwOO/cWFalk/vhvfg1oRdgUAPHdUlmPsZUktA
+OT4q0i/2FX+UGRlE14XEtZ4q4uPKjaSPhCK4DQIDAQABox4wHDAMBgNVHRMBAf8E
+AjAAMAwGA1UdEgEB/wQCMAAwDQYJKoZIhvcNAQELBQADgYEAEhjkLtvc0duYxxWI
+XhBHnYlVuENEKzD/yrkZdP/zBcNgu/k6XmFB2qMDWc2uOdALg+PfGeUaknkJ1m3k
+AEwyRc9/PryWxi59gNWuEcY9TIG7lzmfVXQ21Rlj6iVDvI6riIbnU4/oMJpRPvFv
+oiFDtcjYC4RlqNUGVfQ4uTWQ7kc=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_pubCA1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_pubCA1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs2_pubCA1/emailAddress=cs2_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:bc:d4:1e:7a:76:36:24:10:2f:84:b3:ed:24:8f:
-                    0b:85:8a:17:39:2f:15:26:0a:80:e2:60:aa:c0:00:
-                    af:d5:ba:9c:ef:b0:3a:09:31:e7:97:37:82:ea:32:
-                    a0:c5:75:c3:0e:0f:6a:77:ef:66:77:2f:6a:a2:60:
-                    5b:b7:86:39:df:12:94:4e:61:79:de:dd:d2:fc:d1:
-                    a0:ba:fe:6a:24:09:3b:4f:1e:35:19:e2:15:25:8b:
-                    7c:03:19:66:3d:10:45:91:9c:83:9a:71:c9:b2:eb:
-                    df:a9:64:c7:2d:5a:93:23:d3:5d:ec:64:03:64:f4:
-                    34:b9:ee:40:1d:df:0c:c5:3d
+                    00:d1:1e:d4:1f:8e:07:3a:4f:d3:23:c7:80:1a:ea:
+                    17:87:6b:38:d4:f8:1c:9b:1d:22:de:41:47:d0:dd:
+                    65:9f:63:92:a1:a0:a4:58:22:53:dd:68:bd:86:a8:
+                    88:a3:a9:64:15:fb:b2:75:6a:bb:cd:f0:d8:11:40:
+                    80:ce:2a:55:8f:15:d4:86:f9:2a:47:81:e1:1f:89:
+                    02:4d:ce:7f:9a:34:b3:87:08:d3:fd:1f:db:02:09:
+                    9c:c6:e6:83:f6:79:78:97:cc:aa:e8:47:0b:d2:f7:
+                    9d:55:31:50:e4:ae:d6:24:b2:f5:57:bf:0e:76:ae:
+                    f7:9c:c0:04:66:b0:3e:7c:4f
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,28 +29,28 @@
                 URI:http://localhost:12001/file/0/pubCA1_ta1_crl.pem
 
     Signature Algorithm: sha256WithRSAEncryption
-        39:29:a1:18:73:e2:98:bd:03:ed:99:eb:dc:f3:a3:da:cb:3e:
-        b3:5e:4c:f5:27:2f:c0:9d:7b:d1:3b:97:dc:cc:00:ca:f3:81:
-        48:65:d5:a8:07:42:25:8e:9e:66:38:eb:ca:68:f3:f0:15:95:
-        21:7b:c9:ec:9b:b1:af:dc:63:95:a2:cd:8c:dc:88:f5:7d:37:
-        2f:20:02:ea:b9:c5:e3:64:c2:4a:2d:94:54:10:4e:b9:07:8a:
-        46:99:7c:26:40:82:e5:65:30:df:66:02:6c:17:d8:6e:95:d4:
-        ff:09:25:15:0b:68:7b:ab:84:35:c9:3f:ec:3f:92:76:f2:59:
-        c2:50
+        89:bf:be:5d:02:b5:ce:54:5d:07:30:23:a2:bf:4d:9f:28:97:
+        e1:71:2a:fa:28:42:9e:21:db:7f:e2:58:9e:a2:09:37:6c:85:
+        cc:02:8b:fc:8b:d7:f1:d3:86:93:64:7e:bd:4c:6f:1d:90:30:
+        b4:b0:f7:57:81:0a:f1:1d:1d:9c:8b:a4:da:1b:9a:ff:0f:4b:
+        e4:75:04:10:b1:a8:65:3a:08:2e:02:ae:eb:c6:8f:c0:d9:9c:
+        40:df:0d:58:a6:3f:11:bd:68:a5:2c:58:b9:02:b2:21:d4:e3:
+        c8:da:68:52:fd:26:31:34:8a:19:8d:e0:87:c7:23:46:40:92:
+        ba:31
 -----BEGIN CERTIFICATE-----
 MIICtTCCAh6gAwIBAgIBBzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gyX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gy
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczJfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjczJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC81B56
-djYkEC+Es+0kjwuFihc5LxUmCoDiYKrAAK/VupzvsDoJMeeXN4LqMqDFdcMOD2p3
-72Z3L2qiYFu3hjnfEpROYXne3dL80aC6/mokCTtPHjUZ4hUli3wDGWY9EEWRnIOa
-ccmy69+pZMctWpMj013sZANk9DS57kAd3wzFPQIDAQABo1MwUTAMBgNVHRMBAf8E
+AQkBFgpjczJfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDRHtQf
+jgc6T9Mjx4Aa6heHazjU+BybHSLeQUfQ3WWfY5KhoKRYIlPdaL2GqIijqWQV+7J1
+arvN8NgRQIDOKlWPFdSG+SpHgeEfiQJNzn+aNLOHCNP9H9sCCZzG5oP2eXiXzKro
+RwvS951VMVDkrtYksvVXvw52rvecwARmsD58TwIDAQABo1MwUTAMBgNVHRMBAf8E
 AjAAMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmls
-ZS8wL3B1YkNBMV90YTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQA5KaEYc+KY
-vQPtmevc86Payz6zXkz1Jy/AnXvRO5fczADK84FIZdWoB0Iljp5mOOvKaPPwFZUh
-e8nsm7Gv3GOVos2M3Ij1fTcvIALqucXjZMJKLZRUEE65B4pGmXwmQILlZTDfZgJs
-F9huldT/CSUVC2h7q4Q1yT/sP5J28lnCUA==
+ZS8wL3B1YkNBMV90YTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQCJv75dArXO
+VF0HMCOiv02fKJfhcSr6KEKeIdt/4lieogk3bIXMAov8i9fx04aTZH69TG8dkDC0
+sPdXgQrxHR2ci6TaG5r/D0vkdQQQsahlOgguAq7rxo/A2ZxA3w1Ypj8RvWilLFi5
+ArIh1OPI2mhS/SYxNIoZjeCHxyNGQJK6MQ==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_ta4_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs2_ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,34 +1,34 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 25 (0x19)
+        Serial Number: 32 (0x20)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
         Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
+            Not Before: Jan 28 02:54:23 2011 GMT
+            Not After : Oct 24 02:54:23 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs2_ta4/emailAddress=cs2_ta4
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:d3:11:f2:56:c0:36:ef:ad:7f:18:53:a7:29:77:
-                    9f:6a:82:43:cd:a6:65:0c:5e:ca:39:d9:fa:83:b2:
-                    0d:24:e5:10:ae:85:c5:dc:02:aa:a6:38:4f:31:f3:
-                    b6:ab:47:37:9b:f8:99:80:6c:d3:35:36:81:72:f1:
-                    93:0f:6b:dd:ca:d7:5d:a1:6a:30:74:6e:07:9c:47:
-                    c3:35:69:fc:38:e6:b5:3d:bc:65:e6:ad:67:ea:22:
-                    90:06:d3:eb:aa:64:2f:3e:b3:4c:e1:a4:65:14:8e:
-                    b2:96:85:fc:3c:1d:01:a5:4a:16:1a:b2:84:e9:a8:
-                    03:d1:09:be:7b:3c:3b:0e:ed
+                    00:97:56:b9:2f:de:53:80:7f:22:c6:a7:29:ce:40:
+                    5e:85:76:ad:87:36:38:f2:31:66:99:32:e0:34:2e:
+                    bd:10:a9:26:f5:1e:dc:27:6e:57:4e:9d:37:1b:ad:
+                    14:d2:ba:60:44:2c:13:b2:fc:61:25:33:6f:a9:9e:
+                    d4:4a:52:28:16:51:3d:6c:3a:f1:43:80:6b:c1:69:
+                    d7:71:3a:6e:f7:04:8a:ae:2e:95:70:2a:fc:f0:25:
+                    50:9d:c6:bd:04:4b:89:1c:ae:22:83:cb:45:2e:d3:
+                    7b:74:c4:92:77:ff:bf:5b:a9:73:99:16:30:c9:26:
+                    c2:16:b9:c2:63:93:e6:5b:a7
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                5A:AE:AB:13:F4:60:55:35:31:96:FF:3F:20:AD:22:DF:EE:C7:4E:D3
+                55:DA:B0:E8:E1:F8:5F:D8:68:15:30:36:72:6A:69:CF:9D:A5:F3:FC
             X509v3 Authority Key Identifier: 
-                keyid:EE:8D:78:53:11:FE:07:CB:C8:55:4B:EF:A6:2F:E1:83:72:BB:BA:21
+                keyid:D3:DE:A8:63:F4:5C:5D:8E:DD:53:9F:D7:9E:90:14:71:D1:21:88:4B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:17
+                serial:1E
 
             X509v3 Basic Constraints: critical
                 CA:FALSE
@@ -36,32 +36,32 @@
                 URI:http://localhost:12001/file/0/example_file
 
     Signature Algorithm: sha256WithRSAEncryption
-        4d:74:90:ac:a2:9c:93:39:0c:41:a7:c1:2b:73:56:97:14:32:
-        8d:64:01:78:82:a1:6f:a6:9c:3d:f5:75:80:3e:e2:b5:6c:cf:
-        c8:f2:21:46:05:e2:30:da:ce:41:88:96:87:ac:7b:a6:42:2a:
-        96:f7:1e:8d:4c:92:43:97:8f:99:08:29:47:ce:95:fb:7a:4e:
-        84:2c:0b:80:4b:c9:bf:a1:dc:0b:63:c6:9c:4f:c4:59:12:39:
-        e5:97:ee:6b:6e:86:33:18:43:da:16:5e:51:24:d0:0d:05:92:
-        7d:12:89:cd:21:fc:4e:52:86:9a:02:f9:5e:51:38:62:55:33:
-        d3:db
+        a4:03:ef:02:5d:84:d8:d3:87:f1:57:35:ae:ec:f1:10:22:4c:
+        26:35:fc:8c:25:c3:2e:e6:5b:0c:46:1a:bf:19:8f:af:b4:f3:
+        ad:3e:f0:e2:f5:86:6e:67:fa:d7:9e:d3:db:27:64:df:a5:90:
+        5f:b7:65:8a:47:8a:76:fb:7c:d9:3d:d3:39:17:bc:cc:d6:fc:
+        43:d3:9a:db:8d:10:35:56:7d:88:0e:2c:e8:37:fd:dd:2a:bc:
+        de:79:9e:e2:04:d5:7f:93:fb:1f:e2:de:ca:66:27:10:c5:ea:
+        b2:41:1b:c0:55:04:37:aa:52:65:9c:d1:cd:39:04:e6:6c:45:
+        e0:18
 -----BEGIN CERTIFICATE-----
-MIIDYDCCAsmgAwIBAgIBGTANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIIDYDCCAsmgAwIBAgIBIDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNDAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMHAxCzAJBgNV
+Q0ExX3RhNDAeFw0xMTAxMjgwMjU0MjNaFw0xMzEwMjQwMjU0MjNaMHAxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczJfdGE0MRYwFAYJKoZIhvcNAQkB
-FgdjczJfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDTEfJWwDbvrX8Y
-U6cpd59qgkPNpmUMXso52fqDsg0k5RCuhcXcAqqmOE8x87arRzeb+JmAbNM1NoFy
-8ZMPa93K112hajB0bgecR8M1afw45rU9vGXmrWfqIpAG0+uqZC8+s0zhpGUUjrKW
-hfw8HQGlShYasoTpqAPRCb57PDsO7QIDAQABo4IBAjCB/zAdBgNVHQ4EFgQUWq6r
-E/RgVTUxlv8/IK0i3+7HTtMwgZIGA1UdIwSBijCBh4AU7o14UxH+B8vIVUvvpi/h
-g3K7uiGhbKRqMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMw
+FgdjczJfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCXVrkv3lOAfyLG
+pynOQF6Fdq2HNjjyMWaZMuA0Lr0QqSb1HtwnbldOnTcbrRTSumBELBOy/GElM2+p
+ntRKUigWUT1sOvFDgGvBaddxOm73BIquLpVwKvzwJVCdxr0ES4kcriKDy0Uu03t0
+xJJ3/79bqXOZFjDJJsIWucJjk+ZbpwIDAQABo4IBAjCB/zAdBgNVHQ4EFgQUVdqw
+6OH4X9hoFTA2cmppz52l8/wwgZIGA1UdIwSBijCBh4AU096oY/RcXY7dU5/XnpAU
+cdEhiEuhbKRqMGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMw
 EQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQx
-EjAQBgkqhkiG9w0BCQEWA3RhNIIBFzAMBgNVHRMBAf8EAjAAMDsGA1UdHwQ0MDIw
+EjAQBgkqhkiG9w0BCQEWA3RhNIIBHjAMBgNVHRMBAf8EAjAAMDsGA1UdHwQ0MDIw
 MKAuoCyGKmh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmlsZS8wL2V4YW1wbGVfZmls
-ZTANBgkqhkiG9w0BAQsFAAOBgQBNdJCsopyTOQxBp8Erc1aXFDKNZAF4gqFvppw9
-9XWAPuK1bM/I8iFGBeIw2s5BiJaHrHumQiqW9x6NTJJDl4+ZCClHzpX7ek6ELAuA
-S8m/odwLY8acT8RZEjnll+5rboYzGEPaFl5RJNANBZJ9EonNIfxOUoaaAvleUThi
-VTPT2w==
+ZTANBgkqhkiG9w0BAQsFAAOBgQCkA+8CXYTY04fxVzWu7PEQIkwmNfyMJcMu5lsM
+Rhq/GY+vtPOtPvDi9YZuZ/rXntPbJ2TfpZBft2WKR4p2+3zZPdM5F7zM1vxD05rb
+jRA1Vn2IDizoN/3dKrzeeZ7iBNV/k/sf4t7KZicQxeqyQRvAVQQ3qlJlnNHNOQTm
+bEXgGA==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_p1_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -12,43 +12,43 @@
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:ce:9e:aa:9a:44:62:e4:9d:f2:cd:d1:ef:39:cc:
-                    cb:b8:e9:1a:06:cf:7e:e4:e1:99:52:e0:5a:17:a9:
-                    78:b3:e7:25:c0:97:f8:72:d4:75:50:c5:d9:84:84:
-                    90:cc:53:5e:46:c0:66:d8:0a:76:0c:cf:f7:ff:f8:
-                    fd:e9:f4:60:88:49:74:97:3d:34:f0:90:da:97:5d:
-                    40:1e:78:cb:bf:84:1b:c2:7e:70:cb:b6:79:26:7d:
-                    62:a1:63:60:0b:9f:b3:5a:5f:13:a8:1c:5e:f5:39:
-                    0c:14:d4:67:58:16:09:3b:cf:5c:4a:4a:e6:17:80:
-                    90:69:b5:6d:8d:c8:27:88:9d
+                    00:cd:90:51:4d:d8:59:5e:67:1d:1b:3d:b6:b7:1c:
+                    ff:05:97:c5:12:37:91:68:81:11:2b:85:ce:55:b8:
+                    7a:99:72:c3:53:4a:4e:b6:82:01:7a:44:d1:b4:ea:
+                    12:e0:1f:6a:36:5c:c1:f9:56:a4:cb:a2:ff:4a:d8:
+                    cc:fb:c1:19:3a:0c:e8:c0:3a:ac:f5:d2:32:1c:4e:
+                    2d:16:60:df:84:ae:3e:7b:b5:c3:5c:ac:da:5a:b9:
+                    bc:61:25:c1:ec:d7:df:f9:34:c0:5f:f4:45:56:a1:
+                    a1:f3:43:e1:ac:61:24:c7:ee:ba:89:6f:fa:36:b3:
+                    7d:3a:b1:be:fa:b2:3f:53:15
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        41:c7:40:05:62:dd:88:6f:07:66:78:9b:56:0d:55:77:9e:b7:
-        d1:08:f6:b1:59:cd:85:72:b3:19:fd:0f:c7:4f:a9:54:52:6a:
-        4b:f0:c2:d1:35:6c:1c:cd:71:ee:6f:61:c3:a9:a2:f9:13:68:
-        6a:56:f9:95:c6:da:82:61:9d:de:dd:4b:e1:42:2f:db:80:62:
-        49:31:45:60:c8:d6:3d:1b:49:82:6f:df:1c:a4:ca:01:9a:6f:
-        bc:ff:9e:a8:ec:42:f8:22:f9:70:b3:3a:e6:e2:3e:d2:18:58:
-        89:95:d8:01:fe:b1:25:5e:bc:a2:70:1c:59:5d:e5:af:b1:02:
-        ac:d3
+        49:8f:d8:83:5e:c9:fa:54:40:51:5f:01:ee:23:32:9a:88:c6:
+        c2:57:49:42:61:38:2c:62:86:05:bc:7a:2f:85:5a:e9:d5:73:
+        8e:1d:3f:07:34:bf:69:41:a1:9b:7a:77:50:9f:b0:4a:c7:af:
+        bd:c8:e6:bd:9e:ad:85:85:98:12:e9:ce:0c:e3:3d:55:61:6b:
+        e7:e2:36:79:d4:78:0f:da:ea:b8:7e:18:33:80:48:1f:b8:25:
+        f1:30:d5:a1:59:86:29:5c:dd:a3:74:27:b4:fa:90:06:43:bb:
+        01:a1:72:af:7c:fc:e8:00:fa:6c:ed:7d:55:77:54:13:67:94:
+        6a:31
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBDzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBDzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
 Q0ExX3RhMzAeFw0wOTAxMDEwMTAxMDFaFw0wOTAxMDIwMTAxMDFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczNfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczNfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOnqqa
-RGLknfLN0e85zMu46RoGz37k4ZlS4FoXqXiz5yXAl/hy1HVQxdmEhJDMU15GwGbY
-CnYMz/f/+P3p9GCISXSXPTTwkNqXXUAeeMu/hBvCfnDLtnkmfWKhY2ALn7NaXxOo
-HF71OQwU1GdYFgk7z1xKSuYXgJBptW2NyCeInQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBBx0AFYt2IbwdmeJtW
-DVV3nrfRCPaxWc2FcrMZ/Q/HT6lUUmpL8MLRNWwczXHub2HDqaL5E2hqVvmVxtqC
-YZ3e3UvhQi/bgGJJMUVgyNY9G0mCb98cpMoBmm+8/56o7EL4Ivlwszrm4j7SGFiJ
-ldgB/rElXryicBxZXeWvsQKs0w==
+AQkBFgpjczNfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNkFFN
+2FleZx0bPba3HP8Fl8USN5FogRErhc5VuHqZcsNTSk62ggF6RNG06hLgH2o2XMH5
+VqTLov9K2Mz7wRk6DOjAOqz10jIcTi0WYN+Erj57tcNcrNpaubxhJcHs19/5NMBf
+9EVWoaHzQ+GsYSTH7rqJb/o2s306sb76sj9TFQIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBJj9iDXsn6VEBR
+XwHuIzKaiMbCV0lCYTgsYoYFvHovhVrp1XOOHT8HNL9pQaGbendQn7BKx6+9yOa9
+nq2FhZgS6c4M4z1VYWvn4jZ51HgP2uq4fhgzgEgfuCXxMNWhWYYpXN2jdCe0+pAG
+Q7sBoXKvfPzoAPps7X1Vd1QTZ5RqMQ==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_pubCA1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_pubCA1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,22 +5,22 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2_pubCA1/emailAddress=ch2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:24 2010 GMT
-            Not After : Apr 30 20:59:24 2013 GMT
+            Not Before: Jan 28 02:54:11 2011 GMT
+            Not After : Oct 24 02:54:11 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs3_pubCA1/emailAddress=cs3_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:ae:1e:e7:bd:54:fe:74:88:e0:34:0d:32:b2:1b:
-                    ea:3e:63:fd:7b:1b:13:cc:84:29:e1:f8:7d:c4:9c:
-                    65:aa:3a:2b:fd:c9:7c:03:57:03:b2:12:75:b9:c9:
-                    5e:02:a4:8e:6d:c7:54:c1:cd:e1:30:28:5f:a8:64:
-                    c9:c2:02:e2:3b:af:5e:b3:ec:2c:1c:5c:48:50:07:
-                    87:e4:19:80:ef:b4:78:6f:f2:6f:dd:64:61:97:ce:
-                    a7:29:0a:07:3c:6f:2e:44:fe:38:70:5b:c6:44:bb:
-                    cf:f5:3f:b3:20:3b:3b:81:fa:77:25:ab:1f:4f:f6:
-                    db:28:fd:7f:ba:2f:57:18:47
+                    00:da:26:a1:68:66:ec:6f:7f:7c:94:94:0f:74:17:
+                    52:0e:41:86:ae:43:40:f1:ea:c0:af:e8:51:03:96:
+                    82:4e:35:d4:44:a0:0d:0d:67:2b:44:bf:81:5c:87:
+                    9a:62:42:59:0e:97:81:75:35:6e:18:67:7e:95:41:
+                    47:5c:51:f6:5a:27:dc:b9:2a:2a:ea:5b:6c:b9:59:
+                    78:7c:fb:ff:59:67:5d:35:8b:b7:90:71:29:68:80:
+                    c8:b0:ad:37:60:96:21:34:79:25:41:20:f8:40:e4:
+                    32:90:c0:16:81:c3:b3:47:9f:02:bb:15:7d:32:6d:
+                    5d:75:04:45:cf:23:b5:8e:95
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,28 +29,28 @@
                 URI:http://localhost:12001/file/0/ch1_pubCA1_crl.pem
 
     Signature Algorithm: sha256WithRSAEncryption
-        22:d6:f3:a1:9f:65:9a:2d:d1:3f:50:ea:ba:52:99:1e:1f:95:
-        38:e4:e0:cb:7e:fc:7f:5a:82:75:a4:fa:23:64:7b:4f:63:b1:
-        b5:30:34:38:8e:d1:54:13:a6:1e:7b:3b:f0:3e:94:54:1e:a4:
-        5c:19:3c:38:18:d7:ee:b0:31:ea:ac:d1:b2:18:4b:a7:19:93:
-        45:8f:a2:b6:cf:0b:39:73:b6:80:2e:3d:48:de:18:af:98:4e:
-        cc:15:a2:a4:98:a0:d1:03:36:05:b1:e7:81:94:3b:cd:da:b2:
-        fc:2b:ff:9f:e5:fe:9c:b8:2b:5c:1a:75:00:58:54:a3:f1:4e:
-        cf:53
+        dd:86:89:f4:bb:73:30:c8:1d:74:90:de:cc:b0:7b:a5:0c:30:
+        02:d1:b9:f1:65:c0:f7:2b:cb:60:3b:87:73:ad:dd:0c:fe:d7:
+        7f:93:8f:63:ce:fd:de:30:06:30:1d:b4:40:65:86:a8:19:da:
+        d6:ac:2f:bb:65:49:51:38:6b:44:fb:69:5e:03:e6:c3:80:86:
+        fd:46:4d:c1:4d:c9:7b:85:92:b9:9b:75:72:43:94:75:73:73:
+        06:45:33:3a:5b:16:d0:c3:26:58:39:9c:e6:bf:df:48:b8:72:
+        c3:8a:d3:10:cc:9c:c4:91:e9:85:b6:5e:5d:88:f0:94:df:20:
+        9f:33
 -----BEGIN CERTIFICATE-----
 MIICtTCCAh6gAwIBAgIBCDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKY2gyX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gy
-X3B1YkNBMTAeFw0xMDA4MDQyMDU5MjRaFw0xMzA0MzAyMDU5MjRaMHYxCzAJBgNV
+X3B1YkNBMTAeFw0xMTAxMjgwMjU0MTFaFw0xMzEwMjQwMjU0MTFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczNfcHViQ0ExMRkwFwYJKoZIhvcN
-AQkBFgpjczNfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCuHue9
-VP50iOA0DTKyG+o+Y/17GxPMhCnh+H3EnGWqOiv9yXwDVwOyEnW5yV4CpI5tx1TB
-zeEwKF+oZMnCAuI7r16z7CwcXEhQB4fkGYDvtHhv8m/dZGGXzqcpCgc8by5E/jhw
-W8ZEu8/1P7MgOzuB+nclqx9P9tso/X+6L1cYRwIDAQABo1MwUTAMBgNVHRMBAf8E
+AQkBFgpjczNfcHViQ0ExMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaJqFo
+Zuxvf3yUlA90F1IOQYauQ0Dx6sCv6FEDloJONdREoA0NZytEv4Fch5piQlkOl4F1
+NW4YZ36VQUdcUfZaJ9y5KirqW2y5WXh8+/9ZZ101i7eQcSlogMiwrTdgliE0eSVB
+IPhA5DKQwBaBw7NHnwK7FX0ybV11BEXPI7WOlQIDAQABo1MwUTAMBgNVHRMBAf8E
 AjAAMEEGA1UdHwQ6MDgwNqA0oDKGMGh0dHA6Ly9sb2NhbGhvc3Q6MTIwMDEvZmls
-ZS8wL2NoMV9wdWJDQTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQAi1vOhn2Wa
-LdE/UOq6UpkeH5U45ODLfvx/WoJ1pPojZHtPY7G1MDQ4jtFUE6YeezvwPpRUHqRc
-GTw4GNfusDHqrNGyGEunGZNFj6K2zws5c7aALj1I3hivmE7MFaKkmKDRAzYFseeB
-lDvN2rL8K/+f5f6cuCtcGnUAWFSj8U7PUw==
+ZS8wL2NoMV9wdWJDQTFfY3JsLnBlbTANBgkqhkiG9w0BAQsFAAOBgQDdhon0u3Mw
+yB10kN7MsHulDDAC0bnxZcD3K8tgO4dzrd0M/td/k49jzv3eMAYwHbRAZYaoGdrW
+rC+7ZUlROGtE+2leA+bDgIb9Rk3BTcl7hZK5m3VyQ5R1c3MGRTM6WxbQwyZYOZzm
+v99IuHLDitMQzJzEkemFtl5diPCU3yCfMw==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_ta4_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs3_ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,34 +1,34 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 26 (0x1a)
+        Serial Number: 33 (0x21)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
         Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
+            Not Before: Jan 28 02:54:24 2011 GMT
+            Not After : Oct 24 02:54:24 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs3_ta4/emailAddress=cs3_ta4
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b2:66:56:2e:29:80:41:b1:f4:0f:03:7d:94:35:
-                    7d:67:5f:a6:df:49:c8:47:d8:53:03:0b:97:bb:01:
-                    fb:ba:86:6e:5b:f1:f6:b2:50:fd:c6:4a:8f:16:0d:
-                    4c:6b:95:72:55:a1:26:c1:db:8a:f1:16:e5:06:45:
-                    72:78:5c:54:fa:4b:3e:b2:e9:68:a9:68:4f:c8:19:
-                    8d:40:c1:07:3b:82:b5:ea:60:7c:8f:94:9f:27:81:
-                    79:1e:03:f1:ac:90:42:6b:6f:87:1e:ea:b9:a8:c5:
-                    b1:a4:2a:ff:8c:1c:37:aa:7d:eb:7c:70:2a:5f:e6:
-                    56:60:84:46:e5:a2:3b:11:79
+                    00:df:30:e0:c4:9f:26:44:f8:b3:84:3f:7a:f8:a9:
+                    76:a5:47:03:03:2f:c9:56:78:95:3c:0a:57:da:06:
+                    2d:45:bf:fd:b3:72:5c:e9:89:44:c7:cd:4e:de:a1:
+                    c7:02:33:c2:26:4e:06:34:77:62:5e:85:2f:79:e9:
+                    9b:91:de:c2:24:dc:b7:7c:b3:9d:fe:41:66:26:6c:
+                    8f:37:31:d1:43:ee:ec:8b:ba:b8:86:38:7a:9d:79:
+                    65:ac:f6:ca:fe:a8:ff:36:6a:7c:46:54:80:b7:90:
+                    82:fd:87:85:ac:1a:9a:0d:81:2f:f8:fb:4d:d3:72:
+                    a3:86:5a:85:0f:21:a2:94:b9
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                98:85:12:48:CD:F8:29:DD:17:72:03:5C:40:02:E6:50:F6:24:E7:2D
+                11:88:8F:A2:52:4A:58:E7:DF:84:EC:BF:D8:4F:8B:88:81:5A:A4:B0
             X509v3 Authority Key Identifier: 
-                keyid:EE:8D:78:53:11:FE:07:CB:C8:55:4B:EF:A6:2F:E1:83:72:BB:BA:21
+                keyid:D3:DE:A8:63:F4:5C:5D:8E:DD:53:9F:D7:9E:90:14:71:D1:21:88:4B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:17
+                serial:1E
 
             X509v3 Basic Constraints: critical
                 CA:FALSE
@@ -36,31 +36,31 @@
                 URI:foo://bar/baz
 
     Signature Algorithm: sha256WithRSAEncryption
-        49:ac:6c:a5:ab:c6:c7:ad:f3:93:47:d4:74:7f:4a:d3:46:b0:
-        71:6f:6e:42:e2:7f:f6:ed:db:38:ed:29:09:e1:e0:a0:a7:4c:
-        ec:17:56:a8:71:71:20:2a:da:f0:19:4d:e2:13:3c:6e:db:6a:
-        16:3a:46:63:15:7b:3c:a2:70:f1:6c:14:35:5b:51:80:1c:7e:
-        2c:93:23:ac:31:46:ea:7a:cf:8a:80:b9:45:95:67:ea:b7:c1:
-        cf:b7:0d:99:7b:72:37:29:4d:b3:a0:31:94:e4:55:79:9d:f2:
-        fa:18:c3:f5:fe:77:93:91:17:f1:ce:b7:ae:39:00:b1:5b:98:
-        ab:81
+        ac:a1:4c:cc:d5:75:ae:d4:85:75:01:b3:f6:a0:88:d0:48:25:
+        1b:ca:76:6e:2c:69:df:da:1e:53:89:4e:ed:31:64:a9:a5:96:
+        25:63:15:a1:f5:49:fa:a7:21:5e:8d:84:82:75:74:31:0b:24:
+        03:2d:c0:96:66:f8:40:fb:a4:ca:de:44:1a:a7:ab:08:27:ea:
+        f5:eb:a6:fe:34:a8:8b:61:95:53:51:e7:01:3d:ba:a9:93:be:
+        49:71:11:0d:dd:02:b7:97:15:ff:e6:8d:98:58:0d:fb:4d:5c:
+        e0:28:db:8e:34:3c:40:14:85:84:2d:38:24:56:2d:5c:5f:ac:
+        64:a9
 -----BEGIN CERTIFICATE-----
-MIIDQjCCAqugAwIBAgIBGjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIIDQjCCAqugAwIBAgIBITANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhNDAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMHAxCzAJBgNV
+Q0ExX3RhNDAeFw0xMTAxMjgwMjU0MjRaFw0xMzEwMjQwMjU0MjRaMHAxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRAwDgYDVQQDFAdjczNfdGE0MRYwFAYJKoZIhvcNAQkB
-FgdjczNfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyZlYuKYBBsfQP
-A32UNX1nX6bfSchH2FMDC5e7Afu6hm5b8fayUP3GSo8WDUxrlXJVoSbB24rxFuUG
-RXJ4XFT6Sz6y6WipaE/IGY1AwQc7grXqYHyPlJ8ngXkeA/GskEJrb4ce6rmoxbGk
-Kv+MHDeqfet8cCpf5lZghEblojsReQIDAQABo4HlMIHiMB0GA1UdDgQWBBSYhRJI
-zfgp3RdyA1xAAuZQ9iTnLTCBkgYDVR0jBIGKMIGHgBTujXhTEf4Hy8hVS++mL+GD
-cru6IaFspGowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzAR
+FgdjczNfdGE0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfMODEnyZE+LOE
+P3r4qXalRwMDL8lWeJU8ClfaBi1Fv/2zclzpiUTHzU7eoccCM8ImTgY0d2JehS95
+6ZuR3sIk3Ld8s53+QWYmbI83MdFD7uyLuriGOHqdeWWs9sr+qP82anxGVIC3kIL9
+h4WsGpoNgS/4+03TcqOGWoUPIaKUuQIDAQABo4HlMIHiMB0GA1UdDgQWBBQRiI+i
+UkpY59+E7L/YT4uIgVqksDCBkgYDVR0jBIGKMIGHgBTT3qhj9Fxdjt1Tn9eekBRx
+0SGIS6FspGowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzAR
 BgNVBAcTCk1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDDAKBgNVBAMTA3RhNDES
-MBAGCSqGSIb3DQEJARYDdGE0ggEXMAwGA1UdEwEB/wQCMAAwHgYDVR0fBBcwFTAT
-oBGgD4YNZm9vOi8vYmFyL2JhejANBgkqhkiG9w0BAQsFAAOBgQBJrGylq8bHrfOT
-R9R0f0rTRrBxb25C4n/27ds47SkJ4eCgp0zsF1aocXEgKtrwGU3iEzxu22oWOkZj
-FXs8onDxbBQ1W1GAHH4skyOsMUbqes+KgLlFlWfqt8HPtw2Ze3I3KU2zoDGU5FV5
-nfL6GMP1/neTkRfxzreuOQCxW5irgQ==
+MBAGCSqGSIb3DQEJARYDdGE0ggEeMAwGA1UdEwEB/wQCMAAwHgYDVR0fBBcwFTAT
+oBGgD4YNZm9vOi8vYmFyL2JhejANBgkqhkiG9w0BAQsFAAOBgQCsoUzM1XWu1IV1
+AbP2oIjQSCUbynZuLGnf2h5TiU7tMWSppZYlYxWh9Un6pyFejYSCdXQxCyQDLcCW
+ZvhA+6TK3kQap6sIJ+r166b+NKiLYZVTUecBPbqpk75JcREN3QK3lxX/5o2YWA37
+TVzgKNuONDxAFIWELTgkVi1cX6xkqQ==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs4_p1_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs4_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -12,43 +12,43 @@
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:a5:72:6c:c4:dc:df:15:f5:b0:2f:fb:d2:e2:d9:
-                    f2:2c:5e:0a:c5:04:34:99:0f:06:13:9a:e8:86:2d:
-                    44:2f:57:67:81:a1:93:0e:cd:b5:4b:ca:1a:4b:31:
-                    c6:a7:73:b3:70:66:21:03:6a:cd:a5:bf:4a:6d:96:
-                    d8:50:9e:95:d7:42:84:86:80:f1:15:3f:5c:85:8f:
-                    dd:ee:13:61:c9:2c:71:c1:c1:cb:e8:e9:4d:eb:ce:
-                    d9:57:98:2d:93:81:0e:fb:6d:00:31:9d:db:6f:c2:
-                    aa:b1:36:65:0d:8d:82:7b:e7:df:7c:03:76:f9:b8:
-                    6c:6e:7e:13:5d:85:ac:c0:89
+                    00:e2:60:08:58:af:0f:1b:38:07:8c:9d:b6:88:c5:
+                    99:34:c6:da:7f:37:6b:2e:73:4c:d4:4d:96:c8:9f:
+                    66:61:4c:cc:97:79:b8:af:68:50:3a:4a:78:d1:57:
+                    9a:b4:f3:4d:20:72:e9:5d:eb:99:9f:0d:04:a9:f0:
+                    5b:3f:34:29:b8:b5:28:e1:ea:43:9d:0e:ed:70:4a:
+                    d1:52:13:41:2c:10:6c:5b:bc:8f:65:ff:3b:fc:b6:
+                    27:d7:e9:dc:3b:f8:62:d5:45:85:a5:c1:b7:3d:19:
+                    f9:78:78:90:a4:b6:a5:42:ef:82:f5:17:80:80:63:
+                    9d:2d:51:24:3e:a1:4f:cc:17
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        5f:7c:e0:ae:58:97:b0:36:1e:a7:28:61:9c:0d:2e:cb:34:22:
-        b3:18:7d:d9:0d:2e:2e:0e:0c:79:1f:5e:14:37:c3:cf:7a:41:
-        60:76:a5:0e:ea:c9:eb:f3:5c:7f:0f:39:2e:dc:b8:58:9b:d9:
-        f6:37:f9:53:22:a1:07:57:f9:4e:e3:0e:5b:31:15:7e:88:8d:
-        78:48:18:d5:f9:3a:dd:0b:4a:41:5b:c1:e0:32:8b:3a:ef:ad:
-        36:c8:26:e8:25:52:f7:94:19:99:6e:ff:ec:ac:f3:34:6e:f4:
-        ef:73:e9:6f:2c:8e:c3:96:09:b5:25:68:f9:ce:5c:40:07:47:
-        36:8a
+        a1:8e:31:d1:59:5e:8a:db:6f:b4:46:46:46:80:17:32:c7:f4:
+        47:db:6e:ff:48:8e:1b:0c:5a:ae:aa:31:74:da:37:df:d4:01:
+        1a:6a:7f:7d:16:1a:5c:d8:a3:56:26:9b:c4:47:ff:4b:40:69:
+        3d:a8:e0:25:da:31:51:61:bc:08:b0:47:1a:2d:ae:56:e9:ba:
+        a7:cb:c5:bd:f2:8d:d7:62:72:9d:ff:4d:9f:f7:63:cc:0c:26:
+        19:f1:41:04:f2:82:06:a8:7c:22:ce:7f:af:5a:57:8c:ba:ca:
+        21:8f:95:5d:80:b0:37:6b:c1:7a:ea:3a:7c:3f:c6:bf:42:d7:
+        d4:e4
 -----BEGIN CERTIFICATE-----
-MIICfzCCAeigAwIBAgIBEDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MIICgjCCAeugAwIBAgIBEDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
 Q0ExX3RhMzAeFw0zNTAxMDEwMTAxMDFaFw0zNTAxMDIwMTAxMDFaMHYxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczRfcDFfdGEzMRkwFwYJKoZIhvcN
-AQkBFgpjczRfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQClcmzE
-3N8V9bAv+9Li2fIsXgrFBDSZDwYTmuiGLUQvV2eBoZMOzbVLyhpLMcanc7NwZiED
-as2lv0ptlthQnpXXQoSGgPEVP1yFj93uE2HJLHHBwcvo6U3rztlXmC2TgQ77bQAx
-ndtvwqqxNmUNjYJ75998A3b5uGxufhNdhazAiQIDAQABox0wGzAMBgNVHRMBAf8E
-AjAAMAsGA1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBffOCuWJewNh6nKGGc
-DS7LNCKzGH3ZDS4uDgx5H14UN8PPekFgdqUO6snr81x/Dzku3LhYm9n2N/lTIqEH
-V/lO4w5bMRV+iI14SBjV+TrdC0pBW8HgMos67602yCboJVL3lBmZbv/srPM0bvTv
-c+lvLI7Dlgm1JWj5zlxAB0c2ig==
+AQkBFgpjczRfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDiYAhY
+rw8bOAeMnbaIxZk0xtp/N2suc0zUTZbIn2ZhTMyXebivaFA6SnjRV5q0800gculd
+65mfDQSp8Fs/NCm4tSjh6kOdDu1wStFSE0EsEGxbvI9l/zv8tifX6dw7+GLVRYWl
+wbc9Gfl4eJCktqVC74L1F4CAY50tUSQ+oU/MFwIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQChjjHRWV6K22+0
+RkZGgBcyx/RH227/SI4bDFquqjF02jff1AEaan99Fhpc2KNWJpvER/9LQGk9qOAl
+2jFRYbwIsEcaLa5W6bqny8W98o3XYnKd/02f92PMDCYZ8UEE8oIGqHwizn+vWleM
+usohj5VdgLA3a8F66jp8P8a/QtfU5A==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs4_pubCA1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs4_pubCA1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,50 +5,50 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ch2.2_pubCA1/emailAddress=ch2.2_pubCA1
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:12 2011 GMT
+            Not After : Oct 24 02:54:12 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs4_pubCA1/emailAddress=cs4_pubCA1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b7:e6:67:c1:7f:08:9e:27:00:00:ce:8e:e4:5b:
-                    f5:65:d0:f2:4e:ac:d4:07:b8:21:a2:5a:9b:bd:e3:
-                    48:24:ff:f1:ec:05:49:c2:34:5a:ca:f5:9b:91:2b:
-                    3c:6a:31:ea:3b:25:53:c9:09:3b:2b:24:32:8b:8c:
-                    4c:30:95:78:e9:7c:f0:d7:bc:f8:4e:24:8b:c5:dd:
-                    b4:50:5a:a8:68:78:15:ee:52:73:6e:5a:9a:f9:dd:
-                    7c:39:90:f1:ef:bf:e5:a5:18:dc:d4:d8:a1:8f:2e:
-                    6a:9c:17:dc:20:93:59:e6:c4:3d:bb:f2:a8:0e:ea:
-                    1a:be:a9:54:7f:a2:7b:48:73
+                    00:df:f2:c5:0d:12:9b:77:c9:0f:03:07:db:91:4e:
+                    6a:94:fd:50:fc:2b:78:ab:ad:40:eb:8d:d4:fa:42:
+                    99:5e:68:4a:1c:a7:ca:82:da:4b:22:b1:81:20:b7:
+                    df:e4:c6:df:3f:95:5a:fd:03:8e:47:fc:85:43:d4:
+                    b1:53:d1:cd:6b:eb:82:47:f6:21:35:71:fe:da:c1:
+                    2b:50:d7:61:ef:7e:60:d7:61:3e:64:3f:33:ab:0e:
+                    88:0f:41:3d:15:9e:f5:f1:4f:c3:90:d3:6e:16:32:
+                    5f:33:52:5c:2d:8a:43:dd:23:c5:4a:e7:85:42:29:
+                    03:ee:10:cd:a5:e1:02:73:63
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
                 CA:FALSE
-            X509v3 Key Usage: 
+            X509v3 Key Usage: critical
                 Digital Signature
     Signature Algorithm: sha256WithRSAEncryption
-        6a:34:f8:4a:4b:80:50:1e:e8:bd:17:75:d4:c5:e5:30:b7:63:
-        2f:18:18:e8:24:38:ec:a3:e9:a9:39:f0:2c:4c:83:22:b6:ed:
-        38:9e:08:d4:3e:3d:b6:5e:2f:2d:cd:84:43:60:92:f0:1e:6c:
-        06:6a:86:f3:d9:bb:c7:1c:77:aa:21:b0:0d:34:c6:86:b2:7c:
-        cc:66:12:89:16:eb:39:a6:2f:2b:4b:0e:95:87:4f:28:e3:62:
-        73:c2:99:68:26:ee:5f:e4:64:99:d1:a7:b7:25:66:a8:19:f3:
-        36:c5:b8:1e:7e:ed:10:af:6e:38:a9:9a:03:55:3f:2f:4e:2a:
-        af:9a
+        96:2d:e6:30:36:53:f7:af:a6:40:75:9f:d6:55:7a:8d:71:31:
+        54:f8:61:6c:8e:45:fd:86:5f:1f:88:7c:df:d3:af:5c:1e:da:
+        2d:40:c3:00:b4:a8:05:2d:c2:7c:6e:a7:45:45:26:e9:1f:25:
+        25:9d:b6:2b:1f:7d:ba:79:63:7e:e8:73:2d:49:0e:a5:a3:02:
+        7b:d3:9a:ab:df:55:5e:4d:aa:8e:ae:10:0d:de:50:bd:0e:47:
+        d1:60:ff:4c:87:b7:f4:49:ee:68:3f:f4:a1:dd:b6:72:73:43:
+        fc:3e:b8:4a:f3:7c:6c:95:b3:cb:ba:78:aa:35:5c:b0:48:3e:
+        0d:90
 -----BEGIN CERTIFICATE-----
-MIICgzCCAeygAwIBAgIBCjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzET
+MIIChjCCAe+gAwIBAgIBCjANBgkqhkiG9w0BAQsFADB6MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEVMBMGA1UEAxQMY2gyLjJfcHViQ0ExMRswGQYJKoZIhvcNAQkBFgxj
-aDIuMl9wdWJDQTEwHhcNMTAwODA0MjA1OTI1WhcNMTMwNDMwMjA1OTI1WjB2MQsw
+aDIuMl9wdWJDQTEwHhcNMTEwMTI4MDI1NDEyWhcNMTMxMDI0MDI1NDEyWjB2MQsw
 CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8g
 UGFyazENMAsGA1UEChMEcGtnNTETMBEGA1UEAxQKY3M0X3B1YkNBMTEZMBcGCSqG
 SIb3DQEJARYKY3M0X3B1YkNBMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
-t+ZnwX8InicAAM6O5Fv1ZdDyTqzUB7gholqbveNIJP/x7AVJwjRayvWbkSs8ajHq
-OyVTyQk7KyQyi4xMMJV46Xzw17z4TiSLxd20UFqoaHgV7lJzblqa+d18OZDx77/l
-pRjc1Nihjy5qnBfcIJNZ5sQ9u/KoDuoavqlUf6J7SHMCAwEAAaMdMBswDAYDVR0T
-AQH/BAIwADALBgNVHQ8EBAMCB4AwDQYJKoZIhvcNAQELBQADgYEAajT4SkuAUB7o
-vRd11MXlMLdjLxgY6CQ47KPpqTnwLEyDIrbtOJ4I1D49tl4vLc2EQ2CS8B5sBmqG
-89m7xxx3qiGwDTTGhrJ8zGYSiRbrOaYvK0sOlYdPKONic8KZaCbuX+RkmdGntyVm
-qBnzNsW4Hn7tEK9uOKmaA1U/L04qr5o=
+3/LFDRKbd8kPAwfbkU5qlP1Q/Ct4q61A643U+kKZXmhKHKfKgtpLIrGBILff5Mbf
+P5Va/QOOR/yFQ9SxU9HNa+uCR/YhNXH+2sErUNdh735g12E+ZD8zqw6ID0E9FZ71
+8U/DkNNuFjJfM1JcLYpD3SPFSueFQikD7hDNpeECc2MCAwEAAaMgMB4wDAYDVR0T
+AQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADgYEAli3mMDZT
+96+mQHWf1lV6jXExVPhhbI5F/YZfH4h839OvXB7aLUDDALSoBS3CfG6nRUUm6R8l
+JZ22Kx99unljfuhzLUkOpaMCe9Oaq99VXk2qjq4QDd5QvQ5H0WD/TIe39EnuaD/0
+od22cnND/D64SvN8bJWzy7p4qjVcsEg+DZA=
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs5_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 17 (0x11)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
+        Validity
+            Not Before: Jan 28 02:54:19 2011 GMT
+            Not After : Oct 24 02:54:19 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs5_p1_ta3/emailAddress=cs5_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:f6:3f:57:e4:be:9d:29:77:e5:df:08:72:be:67:
+                    5c:c6:37:e7:ad:62:33:22:74:bb:f2:82:f6:1d:f1:
+                    42:ec:56:c2:6e:d0:bc:f3:e6:a6:91:a1:db:4c:b8:
+                    27:c9:38:3d:c9:d3:e0:78:d0:51:23:22:b2:3f:6f:
+                    4b:1e:14:53:3e:fb:5a:58:f6:fa:f9:cf:ca:ef:89:
+                    34:cd:51:c1:ee:89:32:c4:c1:30:fc:63:51:13:4d:
+                    b4:55:fd:a5:6c:fd:ea:3c:f7:ea:8c:7d:3e:fb:0d:
+                    0e:f7:70:c7:73:ce:01:98:77:fe:db:1f:1c:32:e3:
+                    59:ae:26:b1:1d:eb:3c:83:51
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: 
+                Encipher Only
+    Signature Algorithm: sha256WithRSAEncryption
+        c9:8a:74:1f:0a:fe:1b:e0:19:64:5f:27:2b:1b:e3:d9:45:a0:
+        19:64:00:d8:12:f5:35:e5:65:70:4d:f2:b3:f2:b6:89:81:12:
+        84:56:f7:11:00:ac:79:f8:9f:c6:4e:77:71:3a:f0:da:50:6b:
+        f3:ce:cc:44:38:77:00:c2:d7:33:6f:f4:72:34:33:28:4f:d2:
+        fa:aa:2e:8d:e0:37:2b:ac:ab:b5:9b:ad:63:d8:7a:79:07:c2:
+        3b:f4:1b:9a:b6:93:1f:31:26:6e:3f:38:a3:9c:c9:19:e4:6e:
+        17:6d:49:af:f8:c5:55:cf:24:c8:ee:57:ce:81:e3:75:e1:c3:
+        27:cf
+-----BEGIN CERTIFICATE-----
+MIICfzCCAeigAwIBAgIBETANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTlaFw0xMzEwMjQwMjU0MTlaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczVfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczVfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD2P1fk
+vp0pd+XfCHK+Z1zGN+etYjMidLvygvYd8ULsVsJu0Lzz5qaRodtMuCfJOD3J0+B4
+0FEjIrI/b0seFFM++1pY9vr5z8rviTTNUcHuiTLEwTD8Y1ETTbRV/aVs/eo89+qM
+fT77DQ73cMdzzgGYd/7bHxwy41muJrEd6zyDUQIDAQABox0wGzAMBgNVHRMBAf8E
+AjAAMAsGA1UdDwQEAwIAATANBgkqhkiG9w0BAQsFAAOBgQDJinQfCv4b4BlkXycr
+G+PZRaAZZADYEvU15WVwTfKz8raJgRKEVvcRAKx5+J/GTndxOvDaUGvzzsxEOHcA
+wtczb/RyNDMoT9L6qi6N4DcrrKu1m61j2Hp5B8I79BuatpMfMSZuPzijnMkZ5G4X
+bUmv+MVVzyTI7lfOgeN14cMnzw==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs6_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 18 (0x12)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
+        Validity
+            Not Before: Jan 28 02:54:19 2011 GMT
+            Not After : Oct 24 02:54:19 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs6_p1_ta3/emailAddress=cs6_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c5:6c:6d:f1:28:4b:56:5d:cf:eb:08:28:a6:85:
+                    c9:c4:1a:e6:f9:ca:41:a3:80:c6:52:63:78:43:23:
+                    f9:9c:c2:4a:75:d1:fd:c4:d2:1d:da:c7:e1:d6:a7:
+                    5e:16:ad:58:c2:55:db:a1:59:06:58:0f:04:1d:ef:
+                    68:22:1c:ec:c3:5c:8e:f9:ab:18:5f:63:fc:72:d8:
+                    30:4d:c3:ac:b5:88:d9:be:32:fd:fb:04:e8:7e:86:
+                    89:96:f7:a9:aa:09:62:f6:db:42:5d:91:90:82:4a:
+                    75:ea:7a:a2:3a:13:05:74:c9:c7:75:71:ad:61:3e:
+                    a1:a3:40:63:04:44:9a:a7:e1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+            X509v3 Key Usage: critical
+                Encipher Only
+    Signature Algorithm: sha256WithRSAEncryption
+        ac:fb:c4:5d:a4:05:8c:fa:cf:99:69:0b:25:aa:5f:75:74:0d:
+        b0:96:10:14:71:6c:97:ba:2b:e6:f6:19:80:da:9d:25:89:2f:
+        19:04:ec:c8:2b:da:2a:bc:5a:67:4f:55:fb:f4:e7:c1:de:7e:
+        d3:d7:5c:03:34:00:f2:25:5d:55:75:b4:bc:5f:88:13:a0:ff:
+        8d:6b:ae:78:6f:4e:b8:75:f6:8b:7e:5f:85:ac:1c:2a:62:b9:
+        38:72:84:f3:43:50:23:40:79:c8:7b:5c:6d:2a:97:be:76:a8:
+        98:73:e4:c2:51:d2:46:1b:37:c3:32:72:a2:83:56:7e:73:46:
+        1e:cd
+-----BEGIN CERTIFICATE-----
+MIICgjCCAeugAwIBAgIBEjANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTlaFw0xMzEwMjQwMjU0MTlaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczZfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczZfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDFbG3x
+KEtWXc/rCCimhcnEGub5ykGjgMZSY3hDI/mcwkp10f3E0h3ax+HWp14WrVjCVduh
+WQZYDwQd72giHOzDXI75qxhfY/xy2DBNw6y1iNm+Mv37BOh+homW96mqCWL220Jd
+kZCCSnXqeqI6EwV0ycd1ca1hPqGjQGMERJqn4QIDAQABoyAwHjAMBgNVHRMBAf8E
+AjAAMA4GA1UdDwEB/wQEAwIAATANBgkqhkiG9w0BAQsFAAOBgQCs+8RdpAWM+s+Z
+aQslql91dA2wlhAUcWyXuivm9hmA2p0liS8ZBOzIK9oqvFpnT1X79OfB3n7T11wD
+NADyJV1VdbS8X4gToP+Na654b064dfaLfl+FrBwqYrk4coTzQ1AjQHnIe1xtKpe+
+dqiYc+TCUdJGGzfDMnKig1Z+c0YezQ==
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs7_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,52 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 19 (0x13)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
+        Validity
+            Not Before: Jan 28 02:54:19 2011 GMT
+            Not After : Oct 24 02:54:19 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs7_p1_ta3/emailAddress=cs7_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ba:54:8d:a5:e9:70:76:e3:0b:e5:b9:8f:21:1f:
+                    ef:1e:24:1b:fe:d5:67:95:ba:23:6b:f6:55:69:92:
+                    09:5a:a2:2b:09:72:e7:e5:a7:fb:04:59:cf:27:3f:
+                    8a:b8:28:39:d9:02:24:eb:7a:44:73:6c:29:74:8f:
+                    5a:a4:ff:c4:e1:40:5e:77:8f:24:8c:4e:d8:e0:31:
+                    cf:e6:83:e4:4d:5c:77:29:ae:21:58:84:9f:43:d2:
+                    8e:cb:d4:75:79:96:59:78:00:de:0f:05:25:b0:bf:
+                    81:35:15:27:ac:58:28:09:7a:49:49:17:49:f1:f8:
+                    b9:b7:a1:7f:66:2b:b3:25:7b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:FALSE
+    Signature Algorithm: sha256WithRSAEncryption
+        9f:fc:6d:b4:57:4b:9e:63:53:a8:23:d0:d1:e7:cc:87:bc:37:
+        c6:a7:b0:00:ab:f2:a0:c5:e8:07:56:7a:3d:e3:ff:0e:56:ce:
+        40:78:09:2e:56:6b:9f:13:99:da:50:c8:90:43:6a:e2:88:b7:
+        7d:7d:25:ef:8f:ca:f7:e4:89:f1:07:15:b4:db:48:82:c7:40:
+        5f:58:fe:07:8d:4e:f1:30:eb:99:97:fe:58:67:04:52:34:88:
+        d5:37:c2:fb:a8:07:c3:47:88:5e:11:0b:aa:f0:18:bb:a0:a1:
+        9c:3e:90:b4:44:b9:e5:28:74:6e:9b:ba:e5:40:63:d2:11:aa:
+        9c:bb
+-----BEGIN CERTIFICATE-----
+MIICcjCCAdugAwIBAgIBEzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MTlaFw0xMzEwMjQwMjU0MTlaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczdfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczdfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6VI2l
+6XB24wvluY8hH+8eJBv+1WeVuiNr9lVpkglaoisJcuflp/sEWc8nP4q4KDnZAiTr
+ekRzbCl0j1qk/8ThQF53jySMTtjgMc/mg+RNXHcpriFYhJ9D0o7L1HV5lll4AN4P
+BSWwv4E1FSesWCgJeklJF0nx+Lm3oX9mK7MlewIDAQABoxAwDjAMBgNVHRMBAf8E
+AjAAMA0GCSqGSIb3DQEBCwUAA4GBAJ/8bbRXS55jU6gj0NHnzIe8N8ansACr8qDF
+6AdWej3j/w5WzkB4CS5Wa58TmdpQyJBDauKIt319Je+PyvfkifEHFbTbSILHQF9Y
+/geNTvEw65mX/lhnBFI0iNU3wvuoB8NHiF4RC6rwGLugoZw+kLREueUodG6buuVA
+Y9IRqpy7
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/code_signing_certs/cs8_p1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,54 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 20 (0x14)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
+        Validity
+            Not Before: Jan 28 02:54:20 2011 GMT
+            Not After : Oct 24 02:54:20 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=cs8_p1_ta3/emailAddress=cs8_p1_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ad:72:4f:d0:b8:2b:c4:74:c7:91:71:75:5e:89:
+                    88:2f:d8:bd:af:cd:40:a0:7b:48:87:a4:dc:63:96:
+                    05:79:4c:ba:d7:80:ec:bf:7f:37:9e:6f:62:4c:d6:
+                    e9:10:f0:46:1b:5c:23:f7:57:a1:1f:63:77:b5:4e:
+                    05:fd:17:7e:4a:a6:6d:ed:46:39:c7:e0:45:7b:b7:
+                    6f:39:27:64:57:35:4a:d8:01:37:c6:8e:5b:af:28:
+                    d7:a9:6c:94:23:4b:93:e1:e5:ab:db:7a:0d:b0:2b:
+                    1d:e8:99:f5:2e:89:e9:f6:37:aa:a8:09:fb:e2:0a:
+                    32:59:0b:ec:1b:4e:e5:ad:43
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Digital Signature
+    Signature Algorithm: sha256WithRSAEncryption
+        65:b5:1a:f3:d3:d8:24:ba:ef:c8:38:30:6f:df:d5:06:2d:a3:
+        f0:26:48:7f:77:28:a6:3b:48:40:36:bf:16:50:92:aa:12:33:
+        e9:70:59:be:7a:72:66:b8:64:5e:d8:22:c7:c8:29:a5:e3:00:
+        31:11:91:e6:b5:1c:00:6e:76:be:07:e2:35:62:88:c9:d9:f5:
+        f0:08:bf:2d:b5:e1:db:31:55:86:ee:0b:ee:cd:2f:6b:e0:82:
+        15:42:46:d1:1a:92:b3:f1:7e:4b:1e:65:9e:7c:a3:95:aa:48:
+        7f:23:c8:12:b2:dd:23:57:14:87:94:b5:62:be:bf:ba:44:6e:
+        23:af
+-----BEGIN CERTIFICATE-----
+MIIChTCCAe6gAwIBAgIBFDANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHVi
+Q0ExX3RhMzAeFw0xMTAxMjgwMjU0MjBaFw0xMzEwMjQwMjU0MjBaMHYxCzAJBgNV
+BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
+MQ0wCwYDVQQKEwRwa2c1MRMwEQYDVQQDFApjczhfcDFfdGEzMRkwFwYJKoZIhvcN
+AQkBFgpjczhfcDFfdGEzMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtck/Q
+uCvEdMeRcXVeiYgv2L2vzUCge0iHpNxjlgV5TLrXgOy/fzeeb2JM1ukQ8EYbXCP3
+V6EfY3e1TgX9F35Kpm3tRjnH4EV7t285J2RXNUrYATfGjluvKNepbJQjS5Ph5avb
+eg2wKx3omfUuien2N6qoCfviCjJZC+wbTuWtQwIDAQABoyMwITAPBgNVHRMBAf8E
+BTADAQH/MA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOBgQBltRrz09gk
+uu/IODBv39UGLaPwJkh/dyimO0hANr8WUJKqEjPpcFm+enJmuGRe2CLHyCml4wAx
+EZHmtRwAbna+B+I1YojJ2fXwCL8tteHbMVWG7gvuzS9r4IIVQkbRGpKz8X5LHmWe
+fKOVqkh/I8gSst0jVxSHlLVivr+6RG4jrw==
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/crl/ch1_pubCA1_crl.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/crl/ch1_pubCA1_crl.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,29 +2,29 @@
         Version 1 (0x0)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: /C=US/ST=California/L=Menlo Park/O=pkg5/CN=ch1_pubCA1/emailAddress=ch1_pubCA1
-        Last Update: Aug  4 20:59:24 2010 GMT
-        Next Update: Apr 30 20:59:24 2013 GMT
+        Last Update: Jan 28 02:54:11 2011 GMT
+        Next Update: Oct 24 02:54:11 2013 GMT
 Revoked Certificates:
     Serial Number: 07
-        Revocation Date: Aug  4 20:59:24 2010 GMT
+        Revocation Date: Jan 28 02:54:11 2011 GMT
     Serial Number: 08
-        Revocation Date: Aug  4 20:59:24 2010 GMT
+        Revocation Date: Jan 28 02:54:11 2011 GMT
     Signature Algorithm: sha256WithRSAEncryption
-        65:24:c6:61:0a:72:59:69:de:5e:a4:c8:a5:c8:35:06:30:39:
-        da:b3:ad:a9:cb:1b:f4:9b:ad:45:64:63:b2:ff:2b:bb:e7:65:
-        55:aa:84:0b:e4:bd:fd:a8:51:50:a6:c3:14:11:34:1c:85:8a:
-        d9:b2:20:a0:4c:f5:01:fd:cd:b0:5e:59:a6:b2:7b:a9:14:4e:
-        ad:bc:95:5b:68:ab:d1:ec:89:1a:07:48:a7:d8:f1:ba:b6:38:
-        e6:60:dc:41:6e:16:9c:9d:83:c6:b9:72:3e:c3:7c:b6:de:b7:
-        cc:5c:b2:bf:28:ea:64:d4:de:e8:a6:84:ec:fa:15:92:90:0f:
-        92:44
+        2c:da:bc:ca:35:2f:5d:8e:79:04:05:17:43:d7:85:d1:68:71:
+        6a:0c:9b:dd:4f:a5:1e:d2:fb:70:c6:bf:56:f2:69:b4:b0:f1:
+        bd:e6:41:45:86:f0:be:13:07:ed:4a:06:7f:7b:22:5c:19:1d:
+        d8:89:6b:75:53:b1:07:52:ce:b5:5c:5c:14:fc:80:28:eb:db:
+        d2:8d:16:09:49:97:13:eb:db:16:7d:c6:85:36:0a:72:a8:1e:
+        02:84:8f:b9:cd:84:41:f4:68:07:64:7e:4b:e4:ad:4e:96:8d:
+        6c:4c:31:b2:f7:ca:e9:60:03:c8:df:bc:3b:77:3c:1e:43:30:
+        21:73
 -----BEGIN X509 CRL-----
 MIIBZTCBzzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzETMBEGA1UECBMK
 Q2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtnNTET
 MBEGA1UEAxQKY2gxX3B1YkNBMTEZMBcGCSqGSIb3DQEJARYKY2gxX3B1YkNBMRcN
-MTAwODA0MjA1OTI0WhcNMTMwNDMwMjA1OTI0WjAoMBICAQcXDTEwMDgwNDIwNTky
-NFowEgIBCBcNMTAwODA0MjA1OTI0WjANBgkqhkiG9w0BAQsFAAOBgQBlJMZhCnJZ
-ad5epMilyDUGMDnas62pyxv0m61FZGOy/yu752VVqoQL5L39qFFQpsMUETQchYrZ
-siCgTPUB/c2wXlmmsnupFE6tvJVbaKvR7IkaB0in2PG6tjjmYNxBbhacnYPGuXI+
-w3y23rfMXLK/KOpk1N7opoTs+hWSkA+SRA==
+MTEwMTI4MDI1NDExWhcNMTMxMDI0MDI1NDExWjAoMBICAQcXDTExMDEyODAyNTQx
+MVowEgIBCBcNMTEwMTI4MDI1NDExWjANBgkqhkiG9w0BAQsFAAOBgQAs2rzKNS9d
+jnkEBRdD14XRaHFqDJvdT6Ue0vtwxr9W8mm0sPG95kFFhvC+EwftSgZ/eyJcGR3Y
+iWt1U7EHUs61XFwU/IAo69vSjRYJSZcT69sWfcaFNgpyqB4ChI+5zYRB9GgHZH5L
+5K1Olo1sTDGy98rpYAPI37w7dzweQzAhcw==
 -----END X509 CRL-----
--- a/src/tests/ro_data/signing_certs/produced/crl/pubCA1_ta1_crl.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/crl/pubCA1_ta1_crl.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,27 +2,27 @@
         Version 1 (0x0)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: /C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta1/emailAddress=pubCA1_ta1
-        Last Update: Aug  4 20:59:24 2010 GMT
-        Next Update: Apr 30 20:59:24 2013 GMT
+        Last Update: Jan 28 02:54:11 2011 GMT
+        Next Update: Oct 24 02:54:11 2013 GMT
 Revoked Certificates:
     Serial Number: 07
-        Revocation Date: Aug  4 20:59:24 2010 GMT
+        Revocation Date: Jan 28 02:54:11 2011 GMT
     Signature Algorithm: sha256WithRSAEncryption
-        81:6e:ef:a2:08:9b:98:1a:56:15:c9:12:20:84:a6:43:50:f6:
-        bd:1f:88:0d:54:cd:00:65:d4:92:1a:0f:b0:2b:23:5b:b6:94:
-        08:5d:fd:86:73:ae:d6:27:6e:05:b6:15:59:e9:1e:d3:39:b2:
-        91:29:97:d7:fd:c4:73:b4:5e:85:4c:e5:85:88:d6:0e:34:5d:
-        19:50:de:ec:24:9c:46:7e:a4:2f:81:d0:79:71:a0:bb:d8:c2:
-        4c:95:16:00:b5:8f:36:17:b2:61:57:8c:d5:a9:be:98:1b:05:
-        44:4d:66:ff:de:d6:fd:94:60:81:3c:ad:b7:1b:70:91:6d:2c:
-        82:7f
+        41:4e:ba:b3:ec:4a:41:ab:a2:57:45:78:64:b4:ad:69:7f:48:
+        e6:d7:7b:1c:6e:dd:c4:8a:eb:db:6e:2d:be:a0:e8:3d:87:be:
+        b4:95:1f:e2:6f:ec:01:83:71:cb:d9:eb:ce:88:59:14:cc:bd:
+        20:94:9c:12:48:d7:65:75:0c:83:67:e1:5b:2d:4c:c7:a0:b1:
+        3d:4a:a3:a9:3c:d8:dd:8e:e6:31:26:56:5e:d2:4f:44:29:77:
+        54:b1:40:1f:15:bf:06:07:12:60:3f:cf:c8:65:19:14:d9:f1:
+        58:97:6c:b4:c8:c4:19:b3:c5:ef:de:de:42:68:a1:7e:c3:b8:
+        18:d1
 -----BEGIN X509 CRL-----
 MIIBUTCBuzANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzETMBEGA1UECBMK
 Q2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtnNTET
 MBEGA1UEAxQKcHViQ0ExX3RhMTEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3RhMRcN
-MTAwODA0MjA1OTI0WhcNMTMwNDMwMjA1OTI0WjAUMBICAQcXDTEwMDgwNDIwNTky
-NFowDQYJKoZIhvcNAQELBQADgYEAgW7vogibmBpWFckSIISmQ1D2vR+IDVTNAGXU
-khoPsCsjW7aUCF39hnOu1iduBbYVWeke0zmykSmX1/3Ec7RehUzlhYjWDjRdGVDe
-7CScRn6kL4HQeXGgu9jCTJUWALWPNheyYVeM1am+mBsFRE1m/97W/ZRggTyttxtw
-kW0sgn8=
+MTEwMTI4MDI1NDExWhcNMTMxMDI0MDI1NDExWjAUMBICAQcXDTExMDEyODAyNTQx
+MVowDQYJKoZIhvcNAQELBQADgYEAQU66s+xKQauiV0V4ZLStaX9I5td7HG7dxIrr
+224tvqDoPYe+tJUf4m/sAYNxy9nrzohZFMy9IJScEkjXZXUMg2fhWy1Mx6CxPUqj
+qTzY3Y7mMSZWXtJPRCl3VLFAHxW/BgcSYD/PyGUZFNnxWJdstMjEGbPF797eQmih
+fsO4GNE=
 -----END X509 CRL-----
--- a/src/tests/ro_data/signing_certs/produced/crl/pubCA1_ta4_crl.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/crl/pubCA1_ta4_crl.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,31 +2,31 @@
         Version 1 (0x0)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: /C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta4/emailAddress=pubCA1_ta4
-        Last Update: Aug  4 20:59:28 2010 GMT
-        Next Update: Apr 30 20:59:28 2013 GMT
+        Last Update: Jan 28 02:54:23 2011 GMT
+        Next Update: Oct 24 02:54:23 2013 GMT
 Revoked Certificates:
     Serial Number: 07
-        Revocation Date: Aug  4 20:59:24 2010 GMT
+        Revocation Date: Jan 28 02:54:11 2011 GMT
     Serial Number: 08
-        Revocation Date: Aug  4 20:59:24 2010 GMT
-    Serial Number: 18
-        Revocation Date: Aug  4 20:59:28 2010 GMT
+        Revocation Date: Jan 28 02:54:11 2011 GMT
+    Serial Number: 1F
+        Revocation Date: Jan 28 02:54:22 2011 GMT
     Signature Algorithm: sha256WithRSAEncryption
-        45:47:01:04:a3:e9:cf:1c:cc:43:e6:00:23:34:57:eb:9e:f4:
-        7c:93:88:70:61:dd:6b:b8:7c:8c:97:19:3e:08:f2:f2:64:81:
-        f9:de:62:60:aa:8d:81:f2:c5:f2:6e:42:d4:7e:6b:e0:2c:6c:
-        c1:38:05:0a:84:c5:e2:68:28:b4:82:d1:76:35:0a:43:95:9e:
-        3f:16:48:6d:e1:27:c8:9a:22:fa:e2:63:13:bd:7c:15:4f:e0:
-        d0:39:be:dc:19:97:9a:cf:08:38:17:f0:2c:9f:bf:a4:cf:be:
-        ad:4c:1e:aa:96:96:d8:08:3f:61:ee:c0:b1:78:c2:57:dc:40:
-        66:31
+        39:0f:9c:ed:09:d5:34:f9:bd:1f:7e:a3:2c:3c:06:d9:8a:3c:
+        ee:07:33:34:b8:4a:9c:59:74:fb:8d:5d:06:9c:8c:1e:b3:6d:
+        73:e0:32:86:2d:bf:78:3a:c7:c7:a2:be:ed:cc:08:9f:e7:d3:
+        db:5c:0f:33:67:56:e3:ae:e8:f3:fd:35:58:c7:63:d9:fc:e1:
+        4a:80:2e:65:db:51:a1:6f:ec:a9:d7:a4:c7:37:18:bf:5e:e8:
+        12:18:80:f2:3b:3c:ab:2f:e2:72:34:68:74:e8:2b:40:54:e6:
+        6a:a1:25:12:ed:90:b8:52:c9:60:06:af:7d:d3:c7:11:a8:58:
+        85:bb
 -----BEGIN X509 CRL-----
 MIIBeTCB4zANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzETMBEGA1UECBMK
 Q2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtnNTET
 MBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3RhNBcN
-MTAwODA0MjA1OTI4WhcNMTMwNDMwMjA1OTI4WjA8MBICAQcXDTEwMDgwNDIwNTky
-NFowEgIBCBcNMTAwODA0MjA1OTI0WjASAgEYFw0xMDA4MDQyMDU5MjhaMA0GCSqG
-SIb3DQEBCwUAA4GBAEVHAQSj6c8czEPmACM0V+ue9HyTiHBh3Wu4fIyXGT4I8vJk
-gfneYmCqjYHyxfJuQtR+a+AsbME4BQqExeJoKLSC0XY1CkOVnj8WSG3hJ8iaIvri
-YxO9fBVP4NA5vtwZl5rPCDgX8Cyfv6TPvq1MHqqWltgIP2HuwLF4wlfcQGYx
+MTEwMTI4MDI1NDIzWhcNMTMxMDI0MDI1NDIzWjA8MBICAQcXDTExMDEyODAyNTQx
+MVowEgIBCBcNMTEwMTI4MDI1NDExWjASAgEfFw0xMTAxMjgwMjU0MjJaMA0GCSqG
+SIb3DQEBCwUAA4GBADkPnO0J1TT5vR9+oyw8BtmKPO4HMzS4SpxZdPuNXQacjB6z
+bXPgMoYtv3g6x8eivu3MCJ/n09tcDzNnVuOu6PP9NVjHY9n84UqALmXbUaFv7KnX
+pMc3GL9e6BIYgPI7PKsv4nI0aHToK0BU5mqhJRLtkLhSyWAGr33TxxGoWIW7
 -----END X509 CRL-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/crl/pubCA2_ta4_crl.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,35 @@
+Certificate Revocation List (CRL):
+        Version 1 (0x0)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: /C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA2_ta4/emailAddress=pubCA2_ta4
+        Last Update: Jan 28 02:54:24 2011 GMT
+        Next Update: Oct 24 02:54:24 2013 GMT
+Revoked Certificates:
+    Serial Number: 07
+        Revocation Date: Jan 28 02:54:11 2011 GMT
+    Serial Number: 08
+        Revocation Date: Jan 28 02:54:11 2011 GMT
+    Serial Number: 1F
+        Revocation Date: Jan 28 02:54:22 2011 GMT
+    Serial Number: 23
+        Revocation Date: Jan 28 02:54:24 2011 GMT
+    Signature Algorithm: sha256WithRSAEncryption
+        00:0d:ab:e1:51:f8:3f:36:bb:64:50:1f:d5:2a:00:42:db:4a:
+        5f:a8:b1:d3:a6:5a:3e:51:4d:bb:af:93:6f:be:4e:d2:ca:dc:
+        eb:7d:c5:84:ed:a7:c3:fa:eb:40:e5:04:c1:6c:66:fa:9f:8e:
+        e8:dc:84:5a:94:9d:91:ff:8d:4d:62:72:75:47:39:c7:63:09:
+        fb:33:57:e1:4f:ec:35:6f:e0:55:25:5e:7c:0c:1d:e9:9f:1c:
+        77:a3:2e:34:c3:41:d6:b5:eb:0e:79:7f:72:8c:49:22:af:ed:
+        8e:5f:a0:70:bb:4d:2b:88:50:34:d0:8d:55:86:7e:9c:5b:03:
+        8d:fe
+-----BEGIN X509 CRL-----
+MIIBjTCB9zANBgkqhkiG9w0BAQsFADB2MQswCQYDVQQGEwJVUzETMBEGA1UECBMK
+Q2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtnNTET
+MBEGA1UEAxQKcHViQ0EyX3RhNDEZMBcGCSqGSIb3DQEJARYKcHViQ0EyX3RhNBcN
+MTEwMTI4MDI1NDI0WhcNMTMxMDI0MDI1NDI0WjBQMBICAQcXDTExMDEyODAyNTQx
+MVowEgIBCBcNMTEwMTI4MDI1NDExWjASAgEfFw0xMTAxMjgwMjU0MjJaMBICASMX
+DTExMDEyODAyNTQyNFowDQYJKoZIhvcNAQELBQADgYEAAA2r4VH4Pza7ZFAf1SoA
+QttKX6ix06ZaPlFNu6+Tb75O0src633FhO2nw/rrQOUEwWxm+p+O6NyEWpSdkf+N
+TWJydUc5x2MJ+zNX4U/sNW/gVSVefAwd6Z8cd6MuNMNB1rXrDnl/coxJIq/tjl+g
+cLtNK4hQNNCNVYZ+nFsDjf4=
+-----END X509 CRL-----
--- a/src/tests/ro_data/signing_certs/produced/crl/ta5_crl.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/crl/ta5_crl.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,34 +2,36 @@
         Version 1 (0x0)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: /C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta5/emailAddress=ta5
-        Last Update: Aug  4 20:59:29 2010 GMT
-        Next Update: Apr 30 20:59:29 2013 GMT
+        Last Update: Jan 28 02:54:25 2011 GMT
+        Next Update: Oct 24 02:54:25 2013 GMT
 Revoked Certificates:
     Serial Number: 07
-        Revocation Date: Aug  4 20:59:24 2010 GMT
+        Revocation Date: Jan 28 02:54:11 2011 GMT
     Serial Number: 08
-        Revocation Date: Aug  4 20:59:24 2010 GMT
-    Serial Number: 18
-        Revocation Date: Aug  4 20:59:28 2010 GMT
-    Serial Number: 1B
-        Revocation Date: Aug  4 20:59:29 2010 GMT
+        Revocation Date: Jan 28 02:54:11 2011 GMT
+    Serial Number: 1F
+        Revocation Date: Jan 28 02:54:22 2011 GMT
+    Serial Number: 23
+        Revocation Date: Jan 28 02:54:24 2011 GMT
+    Serial Number: 24
+        Revocation Date: Jan 28 02:54:25 2011 GMT
     Signature Algorithm: sha256WithRSAEncryption
-        8e:92:e0:14:21:89:5b:01:ae:c8:d7:88:ce:fd:18:2b:e3:25:
-        31:9c:2a:a7:41:3c:d1:e1:d7:de:73:95:3b:7f:01:04:0d:46:
-        6f:e1:9a:da:57:63:25:cc:d6:d9:d3:4b:ed:43:fd:6c:a0:96:
-        a1:e9:5a:e0:b2:c4:2b:fd:ae:0a:8d:2b:08:1e:0e:d7:fe:8d:
-        f5:bf:e0:fe:7b:4d:c8:2d:ac:51:8c:0a:cb:b0:77:51:c3:09:
-        ed:4a:75:5b:c7:77:bb:31:9e:62:3f:33:af:95:82:94:83:7c:
-        36:de:b0:e8:7a:b1:e3:7d:86:c0:7f:d8:84:74:73:7c:4b:36:
-        f7:07
+        94:82:fa:b9:39:bb:a6:53:fe:a4:d5:9a:47:d7:9b:0d:f4:b8:
+        29:c1:58:66:47:4a:b0:be:6e:7f:f2:2c:39:0e:5b:1a:24:e7:
+        dd:99:6f:63:19:f2:7c:97:4c:83:ee:df:31:93:0c:44:cb:67:
+        f2:11:16:9b:fb:ee:ab:27:52:6c:00:b9:4e:88:9b:b5:02:ea:
+        b4:df:5b:c4:a7:94:38:b5:2c:90:e9:22:fd:86:3f:03:60:91:
+        1b:36:8c:da:b1:61:27:cd:05:d7:fd:5a:46:c9:c5:9a:9c:b1:
+        7b:52:96:20:6a:d2:ef:cc:47:40:fd:2e:2a:33:b0:20:6d:8d:
+        f7:fb
 -----BEGIN X509 CRL-----
-MIIBfzCB6TANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzETMBEGA1UECBMK
+MIIBkzCB/TANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzETMBEGA1UECBMK
 Q2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtnNTEM
-MAoGA1UEAxMDdGE1MRIwEAYJKoZIhvcNAQkBFgN0YTUXDTEwMDgwNDIwNTkyOVoX
-DTEzMDQzMDIwNTkyOVowUDASAgEHFw0xMDA4MDQyMDU5MjRaMBICAQgXDTEwMDgw
-NDIwNTkyNFowEgIBGBcNMTAwODA0MjA1OTI4WjASAgEbFw0xMDA4MDQyMDU5Mjla
-MA0GCSqGSIb3DQEBCwUAA4GBAI6S4BQhiVsBrsjXiM79GCvjJTGcKqdBPNHh195z
-lTt/AQQNRm/hmtpXYyXM1tnTS+1D/WyglqHpWuCyxCv9rgqNKwgeDtf+jfW/4P57
-TcgtrFGMCsuwd1HDCe1KdVvHd7sxnmI/M6+VgpSDfDbesOh6seN9hsB/2IR0c3xL
-NvcH
+MAoGA1UEAxMDdGE1MRIwEAYJKoZIhvcNAQkBFgN0YTUXDTExMDEyODAyNTQyNVoX
+DTEzMTAyNDAyNTQyNVowZDASAgEHFw0xMTAxMjgwMjU0MTFaMBICAQgXDTExMDEy
+ODAyNTQxMVowEgIBHxcNMTEwMTI4MDI1NDIyWjASAgEjFw0xMTAxMjgwMjU0MjRa
+MBICASQXDTExMDEyODAyNTQyNVowDQYJKoZIhvcNAQELBQADgYEAlIL6uTm7plP+
+pNWaR9ebDfS4KcFYZkdKsL5uf/IsOQ5bGiTn3ZlvYxnyfJdMg+7fMZMMRMtn8hEW
+m/vuqydSbAC5ToibtQLqtN9bxKeUOLUskOki/YY/A2CRGzaM2rFhJ80F1/1aRsnF
+mpyxe1KWIGrS78xHQP0uKjOwIG2N9/s=
 -----END X509 CRL-----
--- a/src/tests/ro_data/signing_certs/produced/index	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/index	Tue Feb 08 23:55:15 2011 -0800
@@ -1,28 +1,37 @@
-V	130430205923Z		01	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i1_ta1/emailAddress=i1_ta1
-V	130430205923Z		02	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i2_ta1/emailAddress=i2_ta1
-V	130430205923Z		03	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta1/emailAddress=pubCA1_ta1
-V	130430205923Z		04	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ch1_pubCA1/emailAddress=ch1_pubCA1
-V	130430205923Z		05	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ch2_pubCA1/emailAddress=ch2_pubCA1
-V	130430205924Z		06	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_pubCA1/emailAddress=cs1_pubCA1
-R	130430205924Z	100804205924Z	07	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs2_pubCA1/emailAddress=cs2_pubCA1
-R	130430205924Z	100804205924Z	08	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs3_pubCA1/emailAddress=cs3_pubCA1
-V	130430205924Z		09	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ch2.2_pubCA1/emailAddress=ch2.2_pubCA1
-V	130430205925Z		0A	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs4_pubCA1/emailAddress=cs4_pubCA1
-V	130430205925Z		0B	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_ta2/emailAddress=cs1_ta2
-V	130430205925Z		0C	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta3/emailAddress=pubCA1_ta3
-V	130430205925Z		0D	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p1_ta3/emailAddress=cs1_p1_ta3
-V	130430205926Z		0E	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs2_p1_ta3/emailAddress=cs2_p1_ta3
+V	131024025410Z		01	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i1_ta1/emailAddress=i1_ta1
+V	131024025410Z		02	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i2_ta1/emailAddress=i2_ta1
+V	131024025410Z		03	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta1/emailAddress=pubCA1_ta1
+V	131024025410Z		04	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ch1_pubCA1/emailAddress=ch1_pubCA1
+V	131024025410Z		05	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ch2_pubCA1/emailAddress=ch2_pubCA1
+V	131024025411Z		06	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_pubCA1/emailAddress=cs1_pubCA1
+R	131024025411Z	110128025411Z	07	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs2_pubCA1/emailAddress=cs2_pubCA1
+R	131024025411Z	110128025411Z	08	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs3_pubCA1/emailAddress=cs3_pubCA1
+V	131024025411Z		09	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ch2.2_pubCA1/emailAddress=ch2.2_pubCA1
+V	131024025412Z		0A	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs4_pubCA1/emailAddress=cs4_pubCA1
+V	131024025413Z		0B	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_ta2/emailAddress=cs1_ta2
+V	131024025413Z		0C	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta3/emailAddress=pubCA1_ta3
+V	131024025413Z		0D	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p1_ta3/emailAddress=cs1_p1_ta3
+V	131024025418Z		0E	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs2_p1_ta3/emailAddress=cs2_p1_ta3
 V	090102010101Z		0F	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs3_p1_ta3/emailAddress=cs3_p1_ta3
 V	350102010101Z		10	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs4_p1_ta3/emailAddress=cs4_p1_ta3
-V	130430205927Z		11	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA2_ta3/emailAddress=pubCA2_ta3
-V	130430205927Z		12	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p2_ta3/emailAddress=cs1_p2_ta3
-V	090102010101Z		13	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA3_ta3/emailAddress=pubCA3_ta3
-V	130430205927Z		14	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p3_ta3/emailAddress=cs1_p3_ta3
-V	350102010101Z		15	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA4_ta3/emailAddress=pubCA4_ta3
-V	130430205928Z		16	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p4_ta3/emailAddress=cs1_p4_ta3
-V	130430205928Z		17	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta4/emailAddress=pubCA1_ta4
-R	130430205928Z	100804205928Z	18	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_ta4/emailAddress=cs1_ta4
-V	130430205929Z		19	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs2_ta4/emailAddress=cs2_ta4
-V	130430205929Z		1A	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs3_ta4/emailAddress=cs3_ta4
-R	130430205929Z	100804205929Z	1B	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta5/emailAddress=pubCA1_ta5
-V	130430205929Z		1C	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_ta5/emailAddress=cs1_ta5
+V	131024025419Z		11	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs5_p1_ta3/emailAddress=cs5_p1_ta3
+V	131024025419Z		12	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs6_p1_ta3/emailAddress=cs6_p1_ta3
+V	131024025419Z		13	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs7_p1_ta3/emailAddress=cs7_p1_ta3
+V	131024025420Z		14	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs8_p1_ta3/emailAddress=cs8_p1_ta3
+V	131024025420Z		15	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_cs8_p1_ta3/emailAddress=cs1_cs8_p1_ta3
+V	131024025420Z		16	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA2_ta3/emailAddress=pubCA2_ta3
+V	131024025421Z		17	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p2_ta3/emailAddress=cs1_p2_ta3
+V	090102010101Z		18	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA3_ta3/emailAddress=pubCA3_ta3
+V	131024025421Z		19	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p3_ta3/emailAddress=cs1_p3_ta3
+V	350102010101Z		1A	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA4_ta3/emailAddress=pubCA4_ta3
+V	131024025421Z		1B	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p4_ta3/emailAddress=cs1_p4_ta3
+V	350102010101Z		1C	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA5_ta3/emailAddress=pubCA5_ta3
+V	131024025421Z		1D	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p5_ta3/emailAddress=cs1_p5_ta3
+V	131024025422Z		1E	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta4/emailAddress=pubCA1_ta4
+R	131024025422Z	110128025422Z	1F	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_ta4/emailAddress=cs1_ta4
+V	131024025423Z		20	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs2_ta4/emailAddress=cs2_ta4
+V	131024025424Z		21	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs3_ta4/emailAddress=cs3_ta4
+V	131024025424Z		22	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA2_ta4/emailAddress=pubCA2_ta4
+R	131024025424Z	110128025424Z	23	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_p2_ta4/emailAddress=cs1_p2_ta4
+R	131024025425Z	110128025425Z	24	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=pubCA1_ta5/emailAddress=pubCA1_ta5
+V	131024025425Z		25	unknown	/C=US/ST=California/L=Menlo Park/O=pkg5/CN=cs1_ta5/emailAddress=cs1_ta5
--- a/src/tests/ro_data/signing_certs/produced/inter_certs/01.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/inter_certs/01.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta1/emailAddress=ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i1_ta1/emailAddress=i1_ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:c6:a6:ce:f9:00:3f:47:3e:3c:72:b0:a7:d8:29:
-                    ec:13:8a:8b:95:d9:c1:93:c2:af:50:f9:21:56:36:
-                    40:5c:8b:08:99:bd:56:5d:91:56:46:5c:e8:ad:44:
-                    ca:8b:b5:29:03:58:a4:e4:19:b3:31:9e:b7:39:ee:
-                    5e:2b:45:a0:36:5c:0c:63:f7:e4:ce:ff:27:e2:bd:
-                    72:3d:fe:a5:36:b8:c6:87:04:8a:78:94:40:56:3f:
-                    8b:da:32:82:99:6c:19:63:ea:a3:c2:21:a2:b9:99:
-                    86:d6:b0:70:38:2e:4f:5b:37:00:ac:c5:8e:73:9f:
-                    3d:cb:ae:0c:6e:b8:d4:1e:31
+                    00:cb:34:c4:83:e1:23:3a:30:58:ea:08:7f:6b:81:
+                    7d:7c:15:1c:72:94:47:9c:af:19:f2:2f:1c:dc:7d:
+                    4f:bd:0e:d1:0d:3c:3f:5c:94:0b:75:e4:a6:ce:c8:
+                    f9:53:40:8b:49:35:b9:76:3a:6f:28:03:f8:a1:1e:
+                    7f:e7:c9:c0:b5:aa:dc:2c:a0:23:94:c6:47:3a:55:
+                    64:50:79:a9:08:e2:ab:9c:7e:b9:84:b4:b2:e6:10:
+                    b6:a2:8e:b1:5a:b4:69:1b:12:d3:8d:7c:44:44:e1:
+                    a1:c7:31:b1:4a:97:63:7e:ab:a5:02:3c:f3:2a:10:
+                    a2:91:3e:63:f9:b0:54:85:87
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                56:66:FB:5E:DF:02:EF:B8:8E:E1:8A:AF:6D:9B:6A:CD:F6:BF:8B:6C
+                7B:97:31:F3:69:92:87:B0:E3:15:19:3F:91:50:24:E5:21:FA:67:61
             X509v3 Authority Key Identifier: 
-                keyid:BB:C9:C7:62:4B:87:B7:6A:32:3F:A5:51:7B:C1:3A:8E:3F:06:5C:F7
+                keyid:15:AB:A2:AB:34:BD:EB:C4:C9:AE:0D:82:51:00:DD:2D:B1:1D:1A:7B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta1/emailAddress=ta1
-                serial:CB:CF:1D:CD:F3:A6:CD:09
+                serial:C1:E4:F1:A8:14:C7:A7:58
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        a2:a3:72:b1:14:ad:a0:f9:c7:4c:76:bb:6d:1e:eb:0d:f9:75:
-        2e:d4:56:30:ac:78:24:9a:1b:9e:78:28:9f:24:da:56:17:9f:
-        fc:e6:18:3d:ce:2a:4e:3a:7d:fe:71:c9:dd:a3:57:ed:7d:ca:
-        f4:6f:f8:e8:fe:7f:b0:db:c3:1b:c8:d2:1b:e1:93:13:df:9f:
-        5c:a7:56:1e:60:91:2d:bd:51:f7:70:80:50:57:c5:78:f0:7f:
-        67:a8:57:08:06:59:0d:04:54:6d:7d:d2:4f:27:d4:c1:dc:73:
-        03:52:e4:69:e6:e9:c4:3a:6d:64:db:21:47:8e:7d:c8:3e:9d:
-        48:3b
+        2a:f6:d1:6c:93:95:9e:b4:ca:91:ba:de:50:8a:de:d4:08:11:
+        2c:5e:70:7b:ce:a2:cc:91:f6:c3:54:c1:ed:07:c0:c1:19:6f:
+        aa:a8:10:f8:f5:83:10:9d:a5:1e:74:f6:0e:dd:74:01:0c:e6:
+        4c:d8:40:40:be:ee:1b:88:bf:eb:51:b8:ac:bc:ab:5c:ea:3c:
+        23:d5:15:8f:a2:df:4d:2c:58:1f:5f:95:c0:c1:d4:71:b3:af:
+        cc:07:6e:51:82:3f:f0:d7:fe:c8:85:a4:48:ae:81:d8:b2:28:
+        11:4a:fb:f1:c3:59:01:6a:54:d7:5f:ff:26:c3:15:5d:d7:cc:
+        a9:bb
 -----BEGIN CERTIFICATE-----
-MIIDHTCCAoagAwIBAgIBATANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDLTCCApagAwIBAgIBATANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcNAQkBFgN0YTEwHhcNMTAw
-ODA0MjA1OTIzWhcNMTMwNDMwMjA1OTIzWjBuMQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcNAQkBFgN0YTEwHhcNMTEw
+MTI4MDI1NDEwWhcNMTMxMDI0MDI1NDEwWjBuMQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTEPMA0GA1UEAxQGaTFfdGExMRUwEwYJKoZIhvcNAQkBFgZpMV90YTEwgZ8wDQYJ
-KoZIhvcNAQEBBQADgY0AMIGJAoGBAMamzvkAP0c+PHKwp9gp7BOKi5XZwZPCr1D5
-IVY2QFyLCJm9Vl2RVkZc6K1Eyou1KQNYpOQZszGetznuXitFoDZcDGP35M7/J+K9
-cj3+pTa4xocEiniUQFY/i9oygplsGWPqo8IhormZhtawcDguT1s3AKzFjnOfPcuu
-DG641B4xAgMBAAGjgdAwgc0wHQYDVR0OBBYEFFZm+17fAu+4juGKr22bas32v4ts
-MIGaBgNVHSMEgZIwgY+AFLvJx2JLh7dqMj+lUXvBOo4/Blz3oWykajBoMQswCQYD
+KoZIhvcNAQEBBQADgY0AMIGJAoGBAMs0xIPhIzowWOoIf2uBfXwVHHKUR5yvGfIv
+HNx9T70O0Q08P1yUC3Xkps7I+VNAi0k1uXY6bygD+KEef+fJwLWq3CygI5TGRzpV
+ZFB5qQjiq5x+uYS0suYQtqKOsVq0aRsS0418REThoccxsUqXY36rpQI88yoQopE+
+Y/mwVIWHAgMBAAGjgeAwgd0wHQYDVR0OBBYEFHuXMfNpkoew4xUZP5FQJOUh+mdh
+MIGaBgNVHSMEgZIwgY+AFBWroqs0vevEya4NglEA3S2xHRp7oWykajBoMQswCQYD
 VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFy
 azENMAsGA1UEChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcNAQkBFgN0
-YTGCCQDLzx3N86bNCTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB
-AKKjcrEUraD5x0x2u20e6w35dS7UVjCseCSaG554KJ8k2lYXn/zmGD3OKk46ff5x
-yd2jV+19yvRv+Oj+f7DbwxvI0hvhkxPfn1ynVh5gkS29UfdwgFBXxXjwf2eoVwgG
-WQ0EVG190k8n1MHccwNS5Gnm6cQ6bWTbIUeOfcg+nUg7
+YTGCCQDB5PGoFMenWDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAN
+BgkqhkiG9w0BAQsFAAOBgQAq9tFsk5WetMqRut5Qit7UCBEsXnB7zqLMkfbDVMHt
+B8DBGW+qqBD49YMQnaUedPYO3XQBDOZM2EBAvu4biL/rUbisvKtc6jwj1RWPot9N
+LFgfX5XAwdRxs6/MB25Rgj/w1/7IhaRIroHYsigRSvvxw1kBalTXX/8mwxVd18yp
+uw==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/inter_certs/02.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/inter_certs/02.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,60 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i1_ta1/emailAddress=i1_ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i2_ta1/emailAddress=i2_ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b9:6b:ec:dd:7f:06:e2:ac:a5:56:89:fa:1b:8b:
-                    07:da:76:d6:a9:62:c0:b2:cf:ff:c1:eb:95:b1:e7:
-                    74:42:ee:af:28:92:3e:86:3a:24:89:f2:60:cd:f3:
-                    29:dd:ad:18:3f:ff:d7:cc:88:5a:36:fd:2d:16:46:
-                    67:6a:08:86:10:2e:fc:cf:3e:cd:bd:c6:30:f2:8c:
-                    c8:63:d2:70:17:1e:c0:b4:27:5c:68:ff:83:1c:4c:
-                    a6:18:2f:43:4e:44:4c:de:44:52:bf:da:da:b4:1b:
-                    ee:85:d8:d7:0a:14:09:42:e9:f4:87:83:f3:85:a6:
-                    81:64:57:b2:12:de:a7:03:27
+                    00:b1:2b:50:52:0e:01:25:b0:1a:8b:58:c2:e3:99:
+                    47:54:32:41:79:5b:5e:2a:37:7a:d8:4a:cf:91:26:
+                    72:71:37:8c:0c:4f:58:4e:52:1b:ed:33:4e:c3:22:
+                    0a:ad:d8:f2:7b:a1:0c:17:79:57:eb:2a:0f:df:4d:
+                    65:e3:73:4e:1b:a7:ba:b2:4b:c0:2c:63:11:73:f4:
+                    12:96:60:d1:06:44:d5:29:b9:df:e1:ba:8b:2f:7d:
+                    df:82:9f:f1:26:e0:d0:ec:2d:cd:f9:53:e8:ea:3e:
+                    3d:e3:45:dd:2f:cb:02:be:b4:88:b9:e7:a9:28:47:
+                    33:39:04:31:96:7f:91:b7:77
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                E3:6D:6B:62:16:42:41:2B:9C:3B:68:01:F3:EF:16:3C:31:83:05:41
+                4A:49:37:7B:87:42:F2:B2:3F:07:11:1E:FC:AD:31:B2:C9:DA:CD:25
             X509v3 Authority Key Identifier: 
-                keyid:56:66:FB:5E:DF:02:EF:B8:8E:E1:8A:AF:6D:9B:6A:CD:F6:BF:8B:6C
+                keyid:7B:97:31:F3:69:92:87:B0:E3:15:19:3F:91:50:24:E5:21:FA:67:61
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta1/emailAddress=ta1
                 serial:01
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        b6:ba:e6:a5:25:c6:2f:d8:b0:ff:68:f5:0f:4b:f3:1e:10:25:
-        68:72:8f:bc:f2:ce:17:ee:81:66:db:18:46:08:7f:07:d3:82:
-        63:99:c4:19:87:cc:d8:cd:cc:e5:fd:6c:c7:c7:39:32:be:f5:
-        94:9f:21:a5:39:df:91:d7:0a:57:6b:e5:41:87:eb:c4:ca:a9:
-        08:05:85:a2:03:89:13:a7:b2:88:ff:91:94:5d:13:6b:97:32:
-        e8:e3:2c:80:42:b2:c9:78:52:9d:23:c9:e8:11:4a:79:9b:d0:
-        9d:d2:10:3d:2e:21:e3:f6:a7:f6:e5:4c:55:a8:f9:0a:bc:13:
-        d7:d5
+        6d:9f:bf:30:b0:53:f9:b5:f6:95:da:a9:ef:fb:77:40:50:19:
+        68:11:5f:08:e9:70:c2:9d:23:2e:25:56:bc:ac:b0:1e:cd:71:
+        c0:94:01:5d:f3:a9:9a:9f:30:a9:72:67:37:6c:cc:d1:66:2a:
+        a7:ec:2c:d4:23:70:8d:e6:20:f3:8e:96:e4:5f:9d:7d:97:f6:
+        8a:62:53:0f:1b:6f:c9:1e:11:31:70:2b:f7:64:6b:63:c8:2f:
+        a9:a2:2e:de:e9:37:81:c9:5f:9e:61:25:2b:d3:3f:f3:46:a1:
+        52:d1:2b:ce:33:eb:0a:a7:bf:c7:35:14:64:2a:1c:00:26:1f:
+        b4:fc
 -----BEGIN CERTIFICATE-----
-MIIDGzCCAoSgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
+MIIDKzCCApSgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEPMA0GA1UEAxQGaTFfdGExMRUwEwYJKoZIhvcNAQkBFgZpMV90YTEw
-HhcNMTAwODA0MjA1OTIzWhcNMTMwNDMwMjA1OTIzWjBuMQswCQYDVQQGEwJVUzET
+HhcNMTEwMTI4MDI1NDEwWhcNMTMxMDI0MDI1NDEwWjBuMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEPMA0GA1UEAxQGaTJfdGExMRUwEwYJKoZIhvcNAQkBFgZpMl90YTEw
-gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALlr7N1/BuKspVaJ+huLB9p21qli
-wLLP/8HrlbHndELuryiSPoY6JInyYM3zKd2tGD//18yIWjb9LRZGZ2oIhhAu/M8+
-zb3GMPKMyGPScBcewLQnXGj/gxxMphgvQ05ETN5EUr/a2rQb7oXY1woUCULp9IeD
-84WmgWRXshLepwMnAgMBAAGjgcgwgcUwHQYDVR0OBBYEFONta2IWQkErnDtoAfPv
-FjwxgwVBMIGSBgNVHSMEgYowgYeAFFZm+17fAu+4juGKr22bas32v4tsoWykajBo
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALErUFIOASWwGotYwuOZR1QyQXlb
+Xio3ethKz5EmcnE3jAxPWE5SG+0zTsMiCq3Y8nuhDBd5V+sqD99NZeNzThunurJL
+wCxjEXP0EpZg0QZE1Sm53+G6iy9934Kf8Sbg0OwtzflT6Oo+PeNF3S/LAr60iLnn
+qShHMzkEMZZ/kbd3AgMBAAGjgdgwgdUwHQYDVR0OBBYEFEpJN3uHQvKyPwcRHvyt
+MbLJ2s0lMIGSBgNVHSMEgYowgYeAFHuXMfNpkoew4xUZP5FQJOUh+mdhoWykajBo
 MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVu
 bG8gUGFyazENMAsGA1UEChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcN
-AQkBFgN0YTGCAQEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQC2
-uualJcYv2LD/aPUPS/MeECVoco+88s4X7oFm2xhGCH8H04JjmcQZh8zYzczl/WzH
-xzkyvvWUnyGlOd+R1wpXa+VBh+vEyqkIBYWiA4kTp7KI/5GUXRNrlzLo4yyAQrLJ
-eFKdI8noEUp5m9Cd0hA9LiHj9qf25UxVqPkKvBPX1Q==
+AQkBFgN0YTGCAQEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
+KoZIhvcNAQELBQADgYEAbZ+/MLBT+bX2ldqp7/t3QFAZaBFfCOlwwp0jLiVWvKyw
+Hs1xwJQBXfOpmp8wqXJnN2zM0WYqp+ws1CNwjeYg846W5F+dfZf2imJTDxtvyR4R
+MXAr92RrY8gvqaIu3uk3gclfnmElK9M/80ahUtErzjPrCqe/xzUUZCocACYftPw=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/inter_certs/i1_ta1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/inter_certs/i1_ta1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta1/emailAddress=ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i1_ta1/emailAddress=i1_ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:c6:a6:ce:f9:00:3f:47:3e:3c:72:b0:a7:d8:29:
-                    ec:13:8a:8b:95:d9:c1:93:c2:af:50:f9:21:56:36:
-                    40:5c:8b:08:99:bd:56:5d:91:56:46:5c:e8:ad:44:
-                    ca:8b:b5:29:03:58:a4:e4:19:b3:31:9e:b7:39:ee:
-                    5e:2b:45:a0:36:5c:0c:63:f7:e4:ce:ff:27:e2:bd:
-                    72:3d:fe:a5:36:b8:c6:87:04:8a:78:94:40:56:3f:
-                    8b:da:32:82:99:6c:19:63:ea:a3:c2:21:a2:b9:99:
-                    86:d6:b0:70:38:2e:4f:5b:37:00:ac:c5:8e:73:9f:
-                    3d:cb:ae:0c:6e:b8:d4:1e:31
+                    00:cb:34:c4:83:e1:23:3a:30:58:ea:08:7f:6b:81:
+                    7d:7c:15:1c:72:94:47:9c:af:19:f2:2f:1c:dc:7d:
+                    4f:bd:0e:d1:0d:3c:3f:5c:94:0b:75:e4:a6:ce:c8:
+                    f9:53:40:8b:49:35:b9:76:3a:6f:28:03:f8:a1:1e:
+                    7f:e7:c9:c0:b5:aa:dc:2c:a0:23:94:c6:47:3a:55:
+                    64:50:79:a9:08:e2:ab:9c:7e:b9:84:b4:b2:e6:10:
+                    b6:a2:8e:b1:5a:b4:69:1b:12:d3:8d:7c:44:44:e1:
+                    a1:c7:31:b1:4a:97:63:7e:ab:a5:02:3c:f3:2a:10:
+                    a2:91:3e:63:f9:b0:54:85:87
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                56:66:FB:5E:DF:02:EF:B8:8E:E1:8A:AF:6D:9B:6A:CD:F6:BF:8B:6C
+                7B:97:31:F3:69:92:87:B0:E3:15:19:3F:91:50:24:E5:21:FA:67:61
             X509v3 Authority Key Identifier: 
-                keyid:BB:C9:C7:62:4B:87:B7:6A:32:3F:A5:51:7B:C1:3A:8E:3F:06:5C:F7
+                keyid:15:AB:A2:AB:34:BD:EB:C4:C9:AE:0D:82:51:00:DD:2D:B1:1D:1A:7B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta1/emailAddress=ta1
-                serial:CB:CF:1D:CD:F3:A6:CD:09
+                serial:C1:E4:F1:A8:14:C7:A7:58
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        a2:a3:72:b1:14:ad:a0:f9:c7:4c:76:bb:6d:1e:eb:0d:f9:75:
-        2e:d4:56:30:ac:78:24:9a:1b:9e:78:28:9f:24:da:56:17:9f:
-        fc:e6:18:3d:ce:2a:4e:3a:7d:fe:71:c9:dd:a3:57:ed:7d:ca:
-        f4:6f:f8:e8:fe:7f:b0:db:c3:1b:c8:d2:1b:e1:93:13:df:9f:
-        5c:a7:56:1e:60:91:2d:bd:51:f7:70:80:50:57:c5:78:f0:7f:
-        67:a8:57:08:06:59:0d:04:54:6d:7d:d2:4f:27:d4:c1:dc:73:
-        03:52:e4:69:e6:e9:c4:3a:6d:64:db:21:47:8e:7d:c8:3e:9d:
-        48:3b
+        2a:f6:d1:6c:93:95:9e:b4:ca:91:ba:de:50:8a:de:d4:08:11:
+        2c:5e:70:7b:ce:a2:cc:91:f6:c3:54:c1:ed:07:c0:c1:19:6f:
+        aa:a8:10:f8:f5:83:10:9d:a5:1e:74:f6:0e:dd:74:01:0c:e6:
+        4c:d8:40:40:be:ee:1b:88:bf:eb:51:b8:ac:bc:ab:5c:ea:3c:
+        23:d5:15:8f:a2:df:4d:2c:58:1f:5f:95:c0:c1:d4:71:b3:af:
+        cc:07:6e:51:82:3f:f0:d7:fe:c8:85:a4:48:ae:81:d8:b2:28:
+        11:4a:fb:f1:c3:59:01:6a:54:d7:5f:ff:26:c3:15:5d:d7:cc:
+        a9:bb
 -----BEGIN CERTIFICATE-----
-MIIDHTCCAoagAwIBAgIBATANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDLTCCApagAwIBAgIBATANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcNAQkBFgN0YTEwHhcNMTAw
-ODA0MjA1OTIzWhcNMTMwNDMwMjA1OTIzWjBuMQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcNAQkBFgN0YTEwHhcNMTEw
+MTI4MDI1NDEwWhcNMTMxMDI0MDI1NDEwWjBuMQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTEPMA0GA1UEAxQGaTFfdGExMRUwEwYJKoZIhvcNAQkBFgZpMV90YTEwgZ8wDQYJ
-KoZIhvcNAQEBBQADgY0AMIGJAoGBAMamzvkAP0c+PHKwp9gp7BOKi5XZwZPCr1D5
-IVY2QFyLCJm9Vl2RVkZc6K1Eyou1KQNYpOQZszGetznuXitFoDZcDGP35M7/J+K9
-cj3+pTa4xocEiniUQFY/i9oygplsGWPqo8IhormZhtawcDguT1s3AKzFjnOfPcuu
-DG641B4xAgMBAAGjgdAwgc0wHQYDVR0OBBYEFFZm+17fAu+4juGKr22bas32v4ts
-MIGaBgNVHSMEgZIwgY+AFLvJx2JLh7dqMj+lUXvBOo4/Blz3oWykajBoMQswCQYD
+KoZIhvcNAQEBBQADgY0AMIGJAoGBAMs0xIPhIzowWOoIf2uBfXwVHHKUR5yvGfIv
+HNx9T70O0Q08P1yUC3Xkps7I+VNAi0k1uXY6bygD+KEef+fJwLWq3CygI5TGRzpV
+ZFB5qQjiq5x+uYS0suYQtqKOsVq0aRsS0418REThoccxsUqXY36rpQI88yoQopE+
+Y/mwVIWHAgMBAAGjgeAwgd0wHQYDVR0OBBYEFHuXMfNpkoew4xUZP5FQJOUh+mdh
+MIGaBgNVHSMEgZIwgY+AFBWroqs0vevEya4NglEA3S2xHRp7oWykajBoMQswCQYD
 VQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFy
 azENMAsGA1UEChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcNAQkBFgN0
-YTGCCQDLzx3N86bNCTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB
-AKKjcrEUraD5x0x2u20e6w35dS7UVjCseCSaG554KJ8k2lYXn/zmGD3OKk46ff5x
-yd2jV+19yvRv+Oj+f7DbwxvI0hvhkxPfn1ynVh5gkS29UfdwgFBXxXjwf2eoVwgG
-WQ0EVG190k8n1MHccwNS5Gnm6cQ6bWTbIUeOfcg+nUg7
+YTGCCQDB5PGoFMenWDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAN
+BgkqhkiG9w0BAQsFAAOBgQAq9tFsk5WetMqRut5Qit7UCBEsXnB7zqLMkfbDVMHt
+B8DBGW+qqBD49YMQnaUedPYO3XQBDOZM2EBAvu4biL/rUbisvKtc6jwj1RWPot9N
+LFgfX5XAwdRxs6/MB25Rgj/w1/7IhaRIroHYsigRSvvxw1kBalTXX/8mwxVd18yp
+uw==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/inter_certs/i2_ta1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/inter_certs/i2_ta1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,60 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i1_ta1/emailAddress=i1_ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i2_ta1/emailAddress=i2_ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b9:6b:ec:dd:7f:06:e2:ac:a5:56:89:fa:1b:8b:
-                    07:da:76:d6:a9:62:c0:b2:cf:ff:c1:eb:95:b1:e7:
-                    74:42:ee:af:28:92:3e:86:3a:24:89:f2:60:cd:f3:
-                    29:dd:ad:18:3f:ff:d7:cc:88:5a:36:fd:2d:16:46:
-                    67:6a:08:86:10:2e:fc:cf:3e:cd:bd:c6:30:f2:8c:
-                    c8:63:d2:70:17:1e:c0:b4:27:5c:68:ff:83:1c:4c:
-                    a6:18:2f:43:4e:44:4c:de:44:52:bf:da:da:b4:1b:
-                    ee:85:d8:d7:0a:14:09:42:e9:f4:87:83:f3:85:a6:
-                    81:64:57:b2:12:de:a7:03:27
+                    00:b1:2b:50:52:0e:01:25:b0:1a:8b:58:c2:e3:99:
+                    47:54:32:41:79:5b:5e:2a:37:7a:d8:4a:cf:91:26:
+                    72:71:37:8c:0c:4f:58:4e:52:1b:ed:33:4e:c3:22:
+                    0a:ad:d8:f2:7b:a1:0c:17:79:57:eb:2a:0f:df:4d:
+                    65:e3:73:4e:1b:a7:ba:b2:4b:c0:2c:63:11:73:f4:
+                    12:96:60:d1:06:44:d5:29:b9:df:e1:ba:8b:2f:7d:
+                    df:82:9f:f1:26:e0:d0:ec:2d:cd:f9:53:e8:ea:3e:
+                    3d:e3:45:dd:2f:cb:02:be:b4:88:b9:e7:a9:28:47:
+                    33:39:04:31:96:7f:91:b7:77
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                E3:6D:6B:62:16:42:41:2B:9C:3B:68:01:F3:EF:16:3C:31:83:05:41
+                4A:49:37:7B:87:42:F2:B2:3F:07:11:1E:FC:AD:31:B2:C9:DA:CD:25
             X509v3 Authority Key Identifier: 
-                keyid:56:66:FB:5E:DF:02:EF:B8:8E:E1:8A:AF:6D:9B:6A:CD:F6:BF:8B:6C
+                keyid:7B:97:31:F3:69:92:87:B0:E3:15:19:3F:91:50:24:E5:21:FA:67:61
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta1/emailAddress=ta1
                 serial:01
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        b6:ba:e6:a5:25:c6:2f:d8:b0:ff:68:f5:0f:4b:f3:1e:10:25:
-        68:72:8f:bc:f2:ce:17:ee:81:66:db:18:46:08:7f:07:d3:82:
-        63:99:c4:19:87:cc:d8:cd:cc:e5:fd:6c:c7:c7:39:32:be:f5:
-        94:9f:21:a5:39:df:91:d7:0a:57:6b:e5:41:87:eb:c4:ca:a9:
-        08:05:85:a2:03:89:13:a7:b2:88:ff:91:94:5d:13:6b:97:32:
-        e8:e3:2c:80:42:b2:c9:78:52:9d:23:c9:e8:11:4a:79:9b:d0:
-        9d:d2:10:3d:2e:21:e3:f6:a7:f6:e5:4c:55:a8:f9:0a:bc:13:
-        d7:d5
+        6d:9f:bf:30:b0:53:f9:b5:f6:95:da:a9:ef:fb:77:40:50:19:
+        68:11:5f:08:e9:70:c2:9d:23:2e:25:56:bc:ac:b0:1e:cd:71:
+        c0:94:01:5d:f3:a9:9a:9f:30:a9:72:67:37:6c:cc:d1:66:2a:
+        a7:ec:2c:d4:23:70:8d:e6:20:f3:8e:96:e4:5f:9d:7d:97:f6:
+        8a:62:53:0f:1b:6f:c9:1e:11:31:70:2b:f7:64:6b:63:c8:2f:
+        a9:a2:2e:de:e9:37:81:c9:5f:9e:61:25:2b:d3:3f:f3:46:a1:
+        52:d1:2b:ce:33:eb:0a:a7:bf:c7:35:14:64:2a:1c:00:26:1f:
+        b4:fc
 -----BEGIN CERTIFICATE-----
-MIIDGzCCAoSgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
+MIIDKzCCApSgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEPMA0GA1UEAxQGaTFfdGExMRUwEwYJKoZIhvcNAQkBFgZpMV90YTEw
-HhcNMTAwODA0MjA1OTIzWhcNMTMwNDMwMjA1OTIzWjBuMQswCQYDVQQGEwJVUzET
+HhcNMTEwMTI4MDI1NDEwWhcNMTMxMDI0MDI1NDEwWjBuMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEPMA0GA1UEAxQGaTJfdGExMRUwEwYJKoZIhvcNAQkBFgZpMl90YTEw
-gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALlr7N1/BuKspVaJ+huLB9p21qli
-wLLP/8HrlbHndELuryiSPoY6JInyYM3zKd2tGD//18yIWjb9LRZGZ2oIhhAu/M8+
-zb3GMPKMyGPScBcewLQnXGj/gxxMphgvQ05ETN5EUr/a2rQb7oXY1woUCULp9IeD
-84WmgWRXshLepwMnAgMBAAGjgcgwgcUwHQYDVR0OBBYEFONta2IWQkErnDtoAfPv
-FjwxgwVBMIGSBgNVHSMEgYowgYeAFFZm+17fAu+4juGKr22bas32v4tsoWykajBo
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALErUFIOASWwGotYwuOZR1QyQXlb
+Xio3ethKz5EmcnE3jAxPWE5SG+0zTsMiCq3Y8nuhDBd5V+sqD99NZeNzThunurJL
+wCxjEXP0EpZg0QZE1Sm53+G6iy9934Kf8Sbg0OwtzflT6Oo+PeNF3S/LAr60iLnn
+qShHMzkEMZZ/kbd3AgMBAAGjgdgwgdUwHQYDVR0OBBYEFEpJN3uHQvKyPwcRHvyt
+MbLJ2s0lMIGSBgNVHSMEgYowgYeAFHuXMfNpkoew4xUZP5FQJOUh+mdhoWykajBo
 MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVu
 bG8gUGFyazENMAsGA1UEChMEcGtnNTEMMAoGA1UEAxMDdGExMRIwEAYJKoZIhvcN
-AQkBFgN0YTGCAQEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQC2
-uualJcYv2LD/aPUPS/MeECVoco+88s4X7oFm2xhGCH8H04JjmcQZh8zYzczl/WzH
-xzkyvvWUnyGlOd+R1wpXa+VBh+vEyqkIBYWiA4kTp7KI/5GUXRNrlzLo4yyAQrLJ
-eFKdI8noEUp5m9Cd0hA9LiHj9qf25UxVqPkKvBPX1Q==
+AQkBFgN0YTGCAQEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwDQYJ
+KoZIhvcNAQELBQADgYEAbZ+/MLBT+bX2ldqp7/t3QFAZaBFfCOlwwp0jLiVWvKyw
+Hs1xwJQBXfOpmp8wqXJnN2zM0WYqp+ws1CNwjeYg846W5F+dfZf2imJTDxtvyR4R
+MXAr92RrY8gvqaIu3uk3gclfnmElK9M/80ahUtErzjPrCqe/xzUUZCocACYftPw=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ch1_pubCA1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ch1_pubCA1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXwIBAAKBgQDfSUyM3SXhTYEIAWXkN9vUh77xyvPC5YKw0skJpD1BKslAxVWq
-C49BQoI8LkcjI4jlVX4/ca7J+di/ueBLdG2CryDwjANL+9lAmb+UkPkANr6nlw2v
-b+PmQwwipyuS3SSPeC7dWm0Fd7YW0YoHT6GvccN6tNNULvWa07FAf+A1cQIDAQAB
-AoGBAMgUwJnBWT5I2wS3a/xS6ZPKiBnWyROt4axdVXRkTddlZa26poaXkSjjVhxj
-Q6+DGhqWv2hOkFfAoK88+nXiwHUbvQrz+6z0qne+Cn0qjYUI/1TxnjGYP6bsiSJT
-3a+7MiNxi/6D87fZ+MDRFTwGzgpglJOzIHkBv9JT/l3po6ChAkEA8sno0QQpqbnh
-TVuD06ULkFxZdJQdINJENNBIP1Ru7oEQz4Ad9M+IRWK0rgUsNT+iPUYCmf6y+qwC
-ymMf0/r2bQJBAOtvt8TfM/coHXaPoFG7AnUs6eT6idCuQ4DNgjSTaI9dKz362cvx
-U5oo7gSy8gzDteeJcDmAWQpmgQL/q6/s6JUCQQCrOhLkNldbyChJcl1Kin/ZVAgS
-29KfLyvDQ5FweI+zzXqZnPWDjknBBZf/ks5Wz4YQSKvVB3gaqe1d5wKvcbMRAkEA
-g4H4tUgz36eRpYsecuixu7/luhhT6LOeUxD33ORF8GaLY+h9xZQ8LY0VPpyx5X1g
-Wz+C5yuREOUmxQUI4pDDbQJBANa1DNHklL9sFrVLX/d0vPuH9mBYc8Tzm+xINqzN
-I1jWCd8HWh/5WHsShRWSkYV/da2j6ME99g4lpvnMKC2dIg4=
+MIICXwIBAAKBgQDYZOTXLEhR3x6l47qO2RGeBUNMFyA3k8mVQAhQx+2nII9R/kW2
+1eZb9TC7lZUuycw9tn0HVXrsNkuSyM2XtA5yQyLdO7wffpreXZc/y0gIyCBkWdnb
+iDo8PW0fV0LAF7NnHTwbGlMCDYyvkYl7TBNJd13BVoArolx5x8bBYZVKNQIDAQAB
+AoGBAKQRy5iB0MuSmlA5HEgWuU7QurfEiP7apOruw99L1xryivgmDIGWKLTscOip
+f5UcGClqZd3bp/nVKPPAIHG3aYM//7u9h4XtVWm/nxlS7kshzgexFEZJjvNVS5he
+oLbgrWcT19YZm38pQHB076qi/Kq41EbwJgKK+NErrUr+herBAkEA755fXQH5ZW2+
+BiysZvFWG0ymL4KMcWcwGdZS2FmiNBcgXN1eMDZ880C3lv9TyVwWpdNl5qkepWwO
+DCnStH/yLQJBAOcwECCNWa97gJ2aHO2T/DFcKJan2OzRw+Bpyw1TR7x+1uV4OuSE
+ur2quYUN3Fxrb4AtA/cK8AIqoHHq0ODTJSkCQQCqTrIQ9PpBcQKCePYAJL/Cn3Pu
+iKcxYtn5Qy+Wvf5fb6B84Im1UsT0T6ctF0SB9YXTTrE6hDFX+bjyRDeSOu3xAkEA
+yVrbMP7rtiNjCeFIgMP7SyJxV4YpMVohuDtsVtbKDCqNEJ9+67mOy9L+chx4aSZJ
+nuGWKnykPb7Sr2VNOAOuwQJBAIcSfpj+ikL9YHg3IE6q/M8mRjDwDjwsMk91BllG
+ds6x4DLIP50V4nmyIPmMP7+2V8F9GvtdmVa41xl4emL9gR0=
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ch2.2_pubCA1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ch2.2_pubCA1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQC4T9hGOM9N+GhkEEoviyzWX4kyRJCJJXb/VGVZ0nWG0JTPLfCU
-GCMy/c70a6DHDvmqGPkL/ueFqv+K4QRT+aQ0dUUHb/GABsrDDzu0RZf+CfUXGGwF
-6TRoud5ho6zhIg9pcm+pqGTLiaM9MgIlZF9JHg9QRxTyCr+McldE+S6eaQIDAQAB
-AoGAbu63uEQ3GbG6eweG7yiwOvLTa6ry52jiP3l3auGOFS9zcWMwGqKQhP9YUap5
-4XV09VkEhKDOjphGKDuY1EY7+sOvSpO1jwUUqS1kHPVhIQHzf5f95v0kSY5lk4s8
-ZD1Tv1lthd2Mc426Zw1n1OnhYU6Ip8Cycp2vesUlmn15eNUCQQDzeLBo+J/tlu5n
-CkjoTGC+XuL21LVysa0ENZRcxZ1E5h6T+NKLo7FBiio5X7dqk23niKgGN3DtT89j
-HR3uQ00LAkEAwcvU/8RwAtpReSoNCOyVqZXX2JTPLKOeysBNft+9c0hgGnIyr7t+
-nduVEm7lgujg6xX+nuRMIsb0kJdEgcji2wJBAOnHaRxiHq4zzpaB+Z+UNxCUa7o2
-ZEPM9ySjjeHGnkwZ6iKLOR97/ifAUurkTWm4Rj+bqDrP4U7841V4D9VIKiECQQCd
-vavCA8Koj8uBNBkoCmpHfxAR2g5H52Z44c4yVyt9iouu+wUGxTZqhzDvsBRgWe25
-bE20R18xb3/hsT6x5THBAkEAvq8eB9U75Kecf4iJt6/1iyhbRa/yMqFP7CeXFq/W
-HyhjL6AL4d+nKhNPfwrz/sOLR7MZTm8ieytFdLNZ2luImw==
+MIICXAIBAAKBgQDIMwuxKkFCjHCIYM1SDqxD1WWdSilN5jKdp64O3QxoPr0LUXdT
+fcgdSaIZI5VBtJsfifshnPgr42XDFyLLxva0zZKuprH0QXieDUxLNjmkjakqER4I
+GoP2PTar0sdI58d9U1RqoAXKXo25f+uRZDjsMg9pZhVSai29XxhxmdQeHQIDAQAB
+AoGAeVKV71OQIOhC+iLPyr6hnqof3mYnCdJLMkd/r/o9np8GqWlBSxOaxkTtOxbZ
+SOxOZZqU2hXqP46bCNNoft2ge3bD9czdVV/TD4OIuKzdve015aI4vTifgYO5CoPf
+rHwtJB6ePh3bWcPc9qIKESG26LOaR/DRvK+cbGYqMt71R4ECQQDsY+8xiKnfY4v2
+0lNlx3H+jw4Er/eeC9JrC0jvyoP2FZnDeK8kDIAuuul2vNMwl6s6oiqCr2tNufgC
+PZ0hnY+FAkEA2M6MMhRQgxTyLWv+BIm+xiZjxrkYwPhe/4FiVt49Z06E41q8J2vz
+EifHC0Q5wWkiXyH847JXAD0Ij/3cykD7uQJASJCs3pHLQ831K0GJZFcDQVd8wCec
+ZaHPaBjAvQt30tTyrLShXvmPZ8js3gw88E++unMJhbB/yg5qeZWcZLNPWQJAKwks
++Q/hP3Pb8ro6DQqOrOSX7610RXHH4a38KEQrKiOC62JqcOTTtinhL9JWKJdG9F1Z
+xpTzAiAbYAHDXv5xOQJBANNvk96SYGPOYZxbLuaxT8V5dPGlcNVHHKStxdDo7AH3
+npFJub+giD04OhLrJybfjWjQ1G7XMr56ZQvZbWgGOJ8=
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ch2_pubCA1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ch2_pubCA1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCxF5QDmRIJHvI/duNjEXU8QUbKPyydL+MvOZBjodAx4bfrlPPF
-fCtK2pvSKClock7IUwyEm2uhfWNJO2XmvhGlukFedA0WrpUmAnnKON8T6feXUs3T
-hUnsz3XNVBPwFQ1l7urleztjPl+pS1bTEB2bR+0vRlRTGbAuY80S9EBKawIDAQAB
-AoGABrTv5Br99d54KjMkdXIJ0JhgR/SQiftwTS+O6lcMfXcg8gkYGliTgyg4UoM2
-3j/GAAw1IyiHsPwAsJtRRqXYITB4Swurdi17HdkamgigtZT9COp9U0SfcbCWgLWx
-1noCIaSh/8keBgTxnrnYf/y+0enrjxodYG6Cxyk5eelud0ECQQDm8lgs53o3Oh1g
-Udp71PGLscO22YjjVMXTtP9aaQ2xzkguGGSVoHOX+Izfqiy8HlJkMIeGi3r/DnXx
-SSapfCqRAkEAxE2haINHysSDw1JQXAJGFjcwsWIPbyNT80aMxM1Q+PJp//uC2Ddj
-sFd3p17lvEtWA/jI/qb0/t1e61UvcopLOwJAQqehYVxxvqzMO7eEKodcK6hjx0tj
-odEew6qSpKJ7bF0QIhWyOik0E6GN7yPrg2Pw/a+v/doV5rVivwAQ44vNsQJBAIEC
-wASO2tzg//ObImMFv4gUJ3U8jAYvgpnMkPE6OnAR6SYp5pkw9dxL78BYtsVkAZjE
-pVvu3+6sEBi7uF4fk0cCQC3DKv42iBPOrDsj4XEFTV3MKTSp9ybigshGerkrpC57
-OOrl3JcfQ9EmtVPNJPeGRXHvzuFyD/szmIx4bToh9rg=
+MIICXAIBAAKBgQDsEIK4vakSnnAuUoli142cpAEHJ+4gkm4HHt1YmFtlb4UbsM3n
+bfazm70fvpMJebb4CkWMxLgio/utlgNrDxi2+tO1NZmSo4KicZO6duS69ocv6KLt
+Kwyn5L+unAMIih4pJWZyFPGZBSwpFE1ZuHHWlXhIfaO5j+ue6Xy4XGVb5wIDAQAB
+AoGAdEMJbp0SKPZZP6csvL52oz/utayHzgjwIZek4h5fXQzYnLOuJR32U60PLxQ3
+7IHCiFTevh6gpYbnzC1Gz7Jms71w1Mwn2wWgMeoRm4XPSUwnHtLCvzAJuPOE4F8L
+VYcyjJlHnggP2aPGPvecf4ANMvu4f+2PPjKkkrox2G8o0OECQQD/Vufo8WQGCgQM
+/uWQWngU53+3WguSNLZ1UUjCAr8kmjt2Ld5Z/ezV3gxCfJb/Z0X4sz+gWnXXPIvC
+6qWdENF3AkEA7KzXGEHf0DrkiR3vpEh8WzdFtQ0wutJ2bx+PqIcZYkdbv8OaZzCa
+gkCFMnyn4PhUmLaB1zmsZnQaMg7+rljlEQJAP3q2mxXwHQQ+b5CrN9EWC3RmLwom
+2ElclxwHL5yJMqtZXw8WOV9EkwLqH1lkHMjq/2Jozg/PPhxiTqoRVFQLDwJBALq6
+GvH+dxCYhlpQDhP1RHfLAeo4P+wFxH8jzXnPLQ3G8vI25wjm5eBB+1S72M+73TKn
+O4WM8SHcFBbOkc0IQaECQBQSsxl3dgAWhxLzRvuORZFmvLD3M40jbfBMrq3TdT2O
+Pj36+GmyGHL2J1dzFeltKmMvFuLwrLyISHnylkMazf4=
 -----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_cs8_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQC3s2evLk/N5oRhgApqDddIPjR2uVHUR0wg0csp88sw+d6+TN07
+fIutKriQSfHl4JPpxHJBt8cerftshFE/tljMFXrPPBb64SkuV5CQW9FVpgx2aoVs
+GXELM8yTu04CWdAI3MuMFx9A3vu6tSTg8LPfsZTRe4DZdKlETrfrzc9i7QIDAQAB
+AoGBAIT6QLcmLizdjrzJpEBLTqkEJpQ+6IZjKi+jzo7K5S7J4j0dhRR3vuCWyU3h
+yVLftBMH2rHJ6EFELnnKespFJJczOYYqRqjpX6DpzsOR5Sdmf6A//U4tgtc3d6b4
+qI8B6GAWTlZl9CXzHr/VEBNMfqrMCcrIhy9mdGpib/hL5vahAkEA9Nojzqbuk7dz
+6Wlgs8sPoT71WmMZoYx482G3bcPIYHjaa9yKcEhywoETTbMhbiexoOLjv9MaeP3y
+S8R8ftnt5QJBAMAQhPx4PQpk0w5bQzro8DSK5oeG4QUmAb2IrAxxaUedjC4KUtBk
+X9QBM9MLab1z0e1WCyP7R1dMGw7C4ERskGkCQQDPzwww6dD2oe7InV0rex5K1ipa
+il1IlPZaagbKLC42YpvOi6EbZwGvPulpOq0W1q2VRLvTJJIFOlKYJ60Z5FBZAkBU
+USxAtfx+KqMpQ1FxdD+3oV7xEnqIyxWqgmydjdBdO0IGGEwg5l/Xb6uzs+f43vbD
+DaoYYsEABw493bmc8Fg5AkBmkWF05L49deIT50ygI0yfrl2aRULhVd6HP2ktvVL1
+8L+emNFwIpes8jCx/w/X201SoQcSmU3x74IYPQpBdRrh
+-----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_p1_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDdjorhXyBldA2R89a9dmdYma7Xmbx4H9C72ZeVQTtCS8zMNtgn
-ACrDJ5JMLV9igQyybRuTyqQcGAmMJiK/gKT+SDeHZGMylUGP9jWYk/Bh8kvrsDQ2
-Z4WhnSF13qufMq46k2RIf+9a+kTiG5+dEDzDnJDd4f4zMUoiy4KrhCoerwIDAQAB
-AoGBAIMROlONJOsfto9rQtQeYZDmiap+BiLCH4ehd60SQ+46TVNZ9pFL5gBBPqjW
-BqGNWmeLaE8MB/2esrc4MEI95lx1oSEVgSQEgFxqCnwQ+8FfZiQr6i/Q7636kI5G
-LcjQ0B5GDdNyI6kbxdtTc0JQak1NWn/S7fjacsEikOj44rLRAkEA8zc2ql427tuy
-5JPD9CmLqGZbRpeQ/nSN3uKp0QPcQCTHc1rRddXTSJI+Vcj8c0lBGN0KJBLPCwVg
-Kd8gAq4C0wJBAOkz4WHGYEhhmuq7+lgfJNFQrngffmsreFURiMbUp9g2BQm+k5q9
-GwnGqoaTzl/UUaQZKbDcKoCMSYXaWm7uszUCQBQbWm+XPl9c1ltDRA3paVxQqfca
-DKicpiXpAzT+ZrT+1WZZ+bsOJFt5i6G37fbx9WnCzFXTID6/AQY1JgZSsHUCQAuu
-mKTAPkSB9zO5FPJjJQIDS6oi0b9mnxGL3lEvh/Txx9DUJirDPF6CADrbnqP4S9qv
-lAITFWH5JRm6dXtHI90CQQDVGdX31C3nFHZafk5O7GUwKQNOGaifcfIQ04ZIwMBO
-HsryI2bRJByldLW2YKtn2RzkHWE6Lp04iG3289qhIeIG
+MIICXQIBAAKBgQD2A2JZm0tCgL2eLFGd1tNbPjaz2ksF7dF3tz7cCocgiVGE5fnw
+nf4d6a3KQ51BjoR96zaFTxTaGO7Jw+fyzZzEERZS1wef9VK3e2bVrhAP/ERtpIlg
+lYUSyjE0Jhu15k9bMcx2dsMSKfZktupE2ulRFdYdWpHLYm7axyVmLzBSFwIDAQAB
+AoGAespvoXgQlW36tuM6DYU3U1h3J0fyoE/2eEF/X4blsUi45pN/MCk7uCR1uPoM
+mLcQzGTFfr5dEwrUzOI6eIdGEeBML1Q/CyG39UrEhNhv5rZTjHh3E+gmUXDQ/yon
+H46JbmGWyoiWx2wQPyu21bi9Yx/D56vHOmFv334D8Uf+tmECQQD7VwnXlOLmX4NJ
+4pRQfZbIExZi80u+z1UN7h1tsDocUKrT1k83MlOI++bQdpM9KT0tWFa8omgOhgr/
+xAHgUPUHAkEA+pMQDTohF/kKxZ6V3UnakRgwdkhzhmuJgryY3hOtRLVb4EvZKgiH
+8vGnfw2jTDmORq2pEWkDK8Js04nvxRoGcQJBANw34OnBDCWpnlEIc8cqowheoQjF
+/6IJ644vCh3ngKL6kxLU/cdxEvw9KnmQy2WVUoL+mdDhw6amD9EVnkc659UCQCO9
+vlhkpjvJJiQyDqZV1ntDvAXjJ7dQt3iSdiuXGuvmAojnyL4aIWoh1gZlZ5mDzCuA
+sdDt7ancPbGexziSEcECQQDGIHQYFB7pKZe/PEOovQTX0gLb7Ogc6eII8sQLXbKk
+RTQ+9f6p0JWuh2HB86N9A6JW/hJodXZZgEiZPdq4XHxZ
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_p2_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_p2_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXwIBAAKBgQDQHvZY4ivQFf7aXF0RhLl8ZUJR4pKeQ8Bxwgu6SwdgFAgnFvUs
-FkRtiQ7Pb0ct7xLfDZ2clM9O8AAcBzts5RBhl/PAIBJsAIedleQ7FN59l3dZmiya
-9qkMID8L2qkTMtOpp184n7V/GQ/x/8Cmf+l2JGZyKc5taqLDPjQKNLjEmwIDAQAB
-AoGBAM4rzgkxTQvfrk9tLnl7TTDxMujhljOYlJ1dCLctOoowbf8jXA+no3QLUZOm
-/hGAA+bZmyiRtmjRkpoxg+oVZcovEsszBHpeqasq1akYtQ+M004On0qn1e2fmeZu
-ecXrhkTKdNqeRR69ENfQmAcs5snYKkmwCEIDDbGnp1wKU4oJAkEA6vBeKkJi4dNQ
-Iw//89wIXMIN9x7u7R13iUQBpJwdPYi0loOPRgXXQBwub/dGcdMorGGjcL7ukLBC
-G7aqUyD77wJBAOLHJXMbYSVYKf1rQtgdwVYP8M6hrCawyTh6Obp0zjjYhr31gy0n
-SEnywUPZs2CtGdBgP9SUcik/sD7zgxIrhhUCQQDI5qb/aCl6huLeOM5cz+luuJqM
-ma0iorIXdUoaY00103LpyrJ35IK+1dp38HIS38jGL/A9d2g13iOJ41gfIfONAkEA
-xe0IC3m3BO/43fxyv8rgheutwbqrVK1xQgCzR8BQiJ66oyqXjZ4+YoQkF8L24wbR
-g+Otci0JomS6v4arO/2OrQJBAMO3XU/aXerYDt+JUcvAeFQCCEI+D9S1jkeXWkuT
-jizIChu1nWAPeY1tCPhwi8CETo5y9oWKzKg4+5RTpEbh0Mw=
+MIICXQIBAAKBgQDGB4ntF00dTOkfwxD4Y1BeYGWbE0EHqVqxXulNb/cVtCOHK5HC
+cZ9PaHHzJKTWu2V4m47FrKQd66xzJBlnY5U0sxhWYgsFxk2ekssxMFgojue48TK8
+z3biIqVW0hil7INlb3GFDGIJqZTH78k5oG8UD7NmNmCVxcLypizGAEr7awIDAQAB
+AoGBAKlx1+38CyrwHWXlFodDC4jFuQsZTYKNwaGVkdGF5Yk3q1LE0CLt8CAVQbOH
+/lgS3z9085RnJcLIXrXjBK23wvlkeRCY/nb4VyN6FUdyV8cWiBRjGb0mDEdCELLB
+CVx8injDNOp99A6ZgyfCmO2Y2BtPae+J4GQT2j8n4oBFq3xpAkEA5t5d1W66IprN
+dKX3tv0+LA7v94G+dSRH48K72v4p7OEgt8V/rQqjM4s/cbBtmq5eOAf6pU/nLUFh
+pfa1utXxVwJBANuWCmFmrYyUgCKxg4XESn6uBg5nJFhRDbS1FkfDvCcw6zzGZS6O
+QdPkr8SHiZrpTGKU3AMC/JzxJKtPYGlp1g0CQQCrsaXxC8br41p2rNNbyFxLYdR+
+qoPdFF1Oek1A4RKG8ypk4UFBjI6wz5cgUshAZ/r0CqMR/Cl904juZ1rhlyhDAkAd
+xsfbk2ffU1fY3IeAQTD04rZRh60HCN657YB69NDz449Sq3iXCpVknXM0TEjdp9tC
+1vrKscH9qjmVvWrOgJqVAkBZjDDSfJnSpCZkGKYJTHE81a0SGbT+30u3Hk3LIbh+
+gtj1aTYm3rRATik0DUMvGQPjqrjJqIlTEGSzRjUFFzuH
 -----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_p2_ta4_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQDL+llzXGfG8zoKedm4nc1u5b8peZ/XoB9gqruIXlUHrp5efkzx
+OiUbcmKBRCuUYC8kN7Elck8U46U47MWPVNThkHFDhtzRqaKEs6i+4u7OV2kp5Wms
+zUXz6RqzOPKl4KCO2AwFCr9e2CJnYAgQzjfLRrJ3/VYIfGLY/F1ppubf4wIDAQAB
+AoGBAMB+PmIepxTaPkDaovuVd+Qazl7+lziutE3OcXGMzCOWx3+XI1dWruQK+yjQ
+Q2wfpP1BzVvwVu74sdhZoUrVHJsckE6Q1LQnpTDfSSXtD2I8RpfCML8fjwwLBC+G
+rozqbcN//lePP3dRvKe3G+uk/GpqcpWgUHHuseKoWXIsmLxRAkEA+MSEkVhj6S5+
+pDzpS9CYs355lTHUOKyTWgMGxdZMhtdR1ryw1UCEe7aGJpfJOd9K5Qly/44Wx1Z/
+ZhcLvLcm+QJBANHoepctuVZNAUcGDbN5hjQw36eh//XCS5fpihtbv1VlStboeHMk
+JsVLINEMXQRbjOpqs+yytGVn3xKWpChaqLsCQQDA3sQVWB1mPZkMRvltwVWS3Hzx
+UkfChPJdeDk5C5QbezdFMNg9Dh9pNzM9GrN1vgx4FOJnBkfc1tBBW57K+okpAkEA
+vET093WmXzZwJ+DRFyGvck5Hu9X8etQK8zUfjwxKX3CboIgfyL4rHBgXVgjtwQPQ
+L00HFgzu6mkw1j5Q/HTcEwJAbIxz0qyjVO4jBDTdG9cLQ/bAH92zkQa77T44auYY
+O4IqIXAG8Tf8QtbKtLbtJyNL7uRVMnb5pTulO/MUT5ISeg==
+-----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_p3_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_p3_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC8gn3fSR8fTH7uJVGW5Emo++6wUbUQ6czwNgdZYTeolXBfUz5U
-7wJG2RKEII9lxFOZ5szZ3tDl0lErPT0IiKM1036/yXDTZYEWMBgOfyJmUgVl0ORl
-EQaN36GX33TE877Sb+4SjRrdFbjkfs0SztRHTdXp18g74ApDekrMEWo4MQIDAQAB
-AoGALfEPhC9p6lLWTGvD6qZQXWKo1UfUfP6993zzZZEP44IoFNNQyZpGT8XvgUv+
-JqsmRMe+/QoUly4eog8WpNHIFJb55TBJLAsW48QM4EExbVuCcbRauDOPfN7uvJd4
-WjPs3vBxJ0mq4WLkEiZVaG1lVgBAEkHBumnrxhdXjaj3LcECQQDmCeXLBbFojoaT
-zq8mc9Ii3i2FEjuLB++1yQ0Gzvcza2UKUXd0MIFkcA2Mb5mcMXxFderWrlSkD2rf
-AL8ezwwFAkEA0cjFkjkvIHuWS48fIw6kY7p3VnTvJQ/banotRW5R4c6rTuofL/YK
-sL+PCdZYQ2ew+k0bYG+uwc+iYcEXQuzfPQJBANA+pYfk33WHkMy9jlGBB/oIp6yP
-lNeHl7k5CFHhimdCEXYFyd2lC32g8qLvZF/BbH51AOLXbkgWrOi0BFAfnwECQAr9
-MmRDfJV+A9R3bdEfTjsvJFsyCujtGLhOKBrv+XgTpGOg3ftcLxktH6gLQ1pcjye9
-bEaz8vqSDtaCD97gm50CQQCR6h+MwbT/tjwknYe9TaN0KHxU4hfL+9Qsvw1tseXq
-9U50DKB8bxFXJE+h3v4cLWy8ofwSxh0D4J0D+NCGyQaZ
+MIICXAIBAAKBgQDW1eH03vOXYeC+kXhfZfG+4WDNbXeTSfRy1xhsPJRqpOj+1Uhw
+8mvvv+EYqy+Tigp/TUdhRgibvS0xorAOC3d2AXdon8Vuq2xsBy5iATnvQ440C93L
+R61YSLscqN/b77QbdxVZleYUKt6Yx3lY4nf39PQIeSGZFlpeQ7A+mK8oAQIDAQAB
+AoGAbwMcfJVMmDgKk07GPb2G+tSpWd2sAV8gwsrlIuD27FiE0VHS2hJatguXvFCR
+CBM3s2pybRBsWFWb6d8gTFGei1gE4UEF7ZWqlQOUc2CtSPXY+JdAfshCnAjQ5fQb
+Z5jBrfNBlXHK231xdT6qGrEn4skx0VmYxw/2JW+X6S9TXAECQQD5rFpurwCpGCtw
+Ay4TCFQ5qbaZ6hzr8Sb9u9e/D5aaqnya4gUk/4VzVN/AHjxkzMs3Z5bwM/lUpZig
+L3EJnvAhAkEA3EeI0k5fWMzVzBiq3pf6Zlo3nAT6D29TeTVbz5CEUOxUedNdfJ99
+Os7NnLRyJwDFRiC1wW0pZpNfGNaDb9a74QJAfB5WhpexOF6vmWu7R/LoDBJ2mGVu
+I00rGRB83JqfQBxo/YZHEHGGoiMbaKKfW20DyXNR8e+kj5QTH+71vtaogQJAeiMn
+2AQgleoteVcMFxQJgQrw3o9b34cIr6JIX9RvqTcAt/PcWCdOlnboRsU+riWdPH8S
+iEdwtzFrfygiBLb5wQJBALMsvMOyZYycMt9ZHs+q5CwFrpNTckO4JryYTADBSy8u
+RoYvp2HSUAKiWOILNMHIPDYFPPieUMTNCGYA0k8FleA=
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_p4_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_p4_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC/QsnnZbTBiIXMmkkp22QFFGC0xKtEfYZRncC6wkHCgPzn6iYU
-8nOvkJiYyO3ridQfp5p6T40KSrVU3jwaXMwYHTnd9SuXphyzdUzaH4a7Hw9nsaDp
-HPkh4C6Y3lxkZn85QngUpc4sspv88lShoq/Mc4CjbdDTKfmum+HWnDoZiQIDAQAB
-AoGAbQe18aOZF3qsS6bobmQS8JJdTq+Ossyb9Yrog46ZzjeZ9NsWOnq8WCkl1HM2
-rj80HZd+CJuw210bYfYObTjZXylrsE95Ss1+qljx8vbWU5IiKimBGWhrKbM8/ulU
-adedJHyctX4h1CXGfmrtz7j6nTD48E79PsAlJqgYAwxeMwECQQDjEc1SD4pkEdZv
-aRjoGKiDmyR0fZEk2Ypfhc58zAcdZMA4oT7NYAmWBDIedjn+fF3mFIqdTRyfOsVC
-wMWwUgd1AkEA16EJUx6AxI3TGobPvOcmLJKoPkRS+GvGN+zACDAVEAt6ucv3if2G
-f9mnn+1aHBJjnnvEHwfXAxlsme7i2CnbRQJATuHNURei/PaRZuy8wUxnpiiMNoe0
-l3eXMW37eLEsO5LXkBS8C360ddAJVTm/FeBAgoBaUyEJs2soQfNT+dfVTQJAVp4T
-ttXr+AjYojFBRaq8xO7ssoaTpcL1TwXFZgSakWVrGTN77mxvGPB/y1h2+AvTBJjH
-AYgOsOoHnBY//YFi2QJANJzFg7k4lWU+UkqJpnWp/O+uqy7RgPenrr2kqrbSW88B
-dLdWm/xPvq+vhXa/pNmEX/Gh3HjIZZzQyeTlXzTVQA==
+MIICXgIBAAKBgQDIJjbXIAsXrNzlIZNfEsxpvDo4yHiKjPmoavMlyiTscXjqUkUV
+yIyWC5UC7UaAQ3b94EXINCaszcBj59CHKSQa1gWUiG0LzRrrxL9fbwHVq6bPAWGq
+6XeT9Z+heH7gXpngyMjLa35Vqxuih6DWJy0+4flWSsTKzEHxalnNI8STEwIDAQAB
+AoGBAIqRknQ79hINFt338eznuegWbgS0HmhmE87bRL3MBuY/5WPtU3EyaMrU9/SP
+y7ivfKll5UoneQM4a9N/Qerhu+ExzOItyk5Jy2rF6QQbL1Ks74KXYAeU5ASCrK0a
+/hUQUycuEzCM1fritnHBoKITF9icgueOmrgB889MSc8A2gMBAkEA95Cj7Vwituln
+ATbzNatir32Z6HwKDVSdDhuRrR+aWIqS2C+rjd5h98QXThazzomIqdUqRdIMjL6r
+mIkC95SwkwJBAM73/sTwbDb1ekMQHw+pnWU3WtluTxsjhsNmS4veeB4mgfV7bSyG
+4rVNtm6FxkSzYEEAjYd9ChXxUicYfPkuo4ECQQCmhOHenGS1R9WDGaUJ6pfcls1Z
+dWWFhe6GOMEKBAHboIoZZCcuq/CVqY5LdjXHrPcB1WIzyI+sc+wUE8StJ5SFAkA3
+94PjSYhZzEPFgsSDfcBcMH3WsieeFRtKF41yQzSEIrGd6kR5d/gyQtOES5Rz23W5
+3iZnbv6dNGacv9h7oYsBAkEA92DuO0bzY2D1xRRB2J609A3xp38fnAsOws4oCSSn
+PXrF9FR+txma/UjY2XjJGxi3K4wCXv1haEstMQ+mDfnn8A==
 -----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_p5_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQCzubxSSWrMj8qObR5AhzrGyQALk+F2RSc+0ozbLAY18wbfS+lj
+Pg5iLZyGbwWjkG5OsonHxWB6j/B6+FMx/uTD5K4JZ0oV9a6XoWwf7AqZ6iVPp/74
+4FXhI7plCDtCrMaxMLXF7RBbPgbQY/va0jng+rYXrMvA7a5Uz/lz5OjkLQIDAQAB
+AoGBAIzwwPA+xtP4hz498BVmdv9grPpnU83t2SL49qEB2zT/iood+75p8dmoLzF1
+axSjtP1eIZJaBJjYvBuTFZsFaturGnQSxDb0hTvt1OOBJJy90nBGLJxpePnVCR4D
+POL/w3ecO4Vk5wd4NfFk7LnntS1qBvfSlJlUUkGpQ8SdP6YBAkEA5QHEaiC/7C9W
+eVxr7WGbzMKbRbDYxcGy8QrkGViWl8+kurMCpaqiyYymeQ7ppDmQkNOXuW/93Suf
+0HkudRH27QJBAMjo6fAUYHvc4KWXc7pl7/JAyupimExIlyFdztYQowhuIW7aLa8A
+rnd1dqmcyBz1264N90LD9SZt+cUV0z6VukECQQC89y5Z3FhBzfXvAqJUKJzk4xg4
+82qME/9SAwihGYZ6Em79V8UxapIU+ahMcE++oXl26AJkk9LI87xVzAjXtVEpAkEA
+ld4ge8VHf73xGbUTT+0wgx5P/21SvDy999bZLpe0ddppOB6qS0wP2O6XeMiKAgho
+ObsTQguY+HS7B4hTTvEzwQJAPMfqfnkzR9TUPos8GOQ6yymDA1+QY3dFE1WpvVHK
+vgvk0syvRpabJiOGb/e/B8Bi2jdlgPimgx4mFK1N9WhfOg==
+-----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_pubCA1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_pubCA1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQCXp7aaQGMSLzxLP3XSU1vJyW58/PaONX96WrL6AOvd8PKHKsmb
-TX4tPPEOTv+0sZGIL8OrrmU5HtroflC1lEimXLC7Qqpw5lCcQSxnOGzgXZp9tJU2
-VOroSCQxHDA5JCwqH97CyL/ogjVKm1KOFeg03wx4vuXGhcZ5iHXABOS4dwIDAQAB
-AoGAT8DaTbpon2qJ2cSw0IAX+EFfQonBm73UoWLLVqBfaiNJV/4PcgXJwj6XQoAX
-B06Oi0EbNNEM2II6eyPai/NEVLGQozV9HgMmbPT1uBjgxBuCibdKOzvmcfShLcdG
-sjYBs8wV1AfYkKsY9M+sctgUiRDo4rkCHEssF3F/iA9jvvkCQQDGlisuEPCYPhKG
-wnucMn7LZl8r3g6UWE4URTLFcrzYAfJxOB+WPfN4kPE0o486k9D4L+W/gfdOrTym
-WaTxHQD9AkEAw4ALHxe7vY2rE4U1ssmRQ1wftXu8eJ8oDR59r33ih2UhCU9w/rs1
-AEzyWac6x9Bd8uUiQF6m++kq9JzZHmdDgwJAG4adHZmDf9a6wqsabyAgqxjZgD8b
-TjyfNfgRfYTV4CsE6+SXnD+iC8grZtx08e2jPYOGGPFu0hz5FyW90x3uEQJAfyiS
-k0e5mkJCKvEzCzYmIN0T1tRDs2U6BMZ3U6UaqZwyj763LUiQ4cAqxfuKtRqncOxu
-idXG4QU5Jl+6rRbXhwJAN64+IlP5rCS8ZdTxwlMz5nik0NEHagMX72jgEbwtiAPt
-QTY3X5Ag/F3+d3Br2QN+FaemC+FuqBYXqpqvLQhjnw==
+MIICXQIBAAKBgQDW4Hj9m+x58ALwzHqLY+Fg40Go2A2CSi3ubFOwayFQQgYupq89
++uhVoHlUMctl+APmhKk9dsx7Bt7TJQ7l45kYfBOecz1ciHpd9VhUCM+//HPQ7771
+BPtxS5iEgjph9QQpSF09wnNWM44O/A06HlfZo3zJ/dsnihre1BNTzqISeQIDAQAB
+AoGBANLhThynL/ej417rbsDp70ClB8Vq9CcQIe/CBIg5O2KGyYZzM70CR43xheFp
+VRLnyvwq6eVWd+utnHVgAzT+nzmp8RRZl+SA/E5v5km5jNnAp50HI8Y4DMbFHtkB
+qTgAZ9SX1OQudSomMjW78cfX4DcvTro1JuIXeyuMQzOiCyG5AkEA7j0MpgxZo0vF
+F/TVkT3mA1kffLh19UUnJF8VqRVFKNQRupgzA+IFhlUEpkVrcwXhq28tFvbQmPPH
+uuBFjeRHUwJBAObljMilI06C7KfYAzdTnpUHLvFYtNfFIfQQZ4O+kT6Yl8AKvlvJ
+/8LhuwAq9qXgAK35Pnm/+Ko8a42WDV1EwYMCQHgBIIHz7qMm45zxozKKL3a4SfgV
+IrXto43ap5qIMFIkoNmRGQF3tLi50qG+jiVebRJh6iCLKwAgrBciKWcT+ikCQQCI
+kHiGK/YH97PVShQM4y5GYqtHH/pGLFh6rEEtUMdDSKlocnJIg977+trJrJ+ZWDXO
+sD5dcEe5GGdcpMVexs3VAkBUBbSfWMgLB+TaOVMRSi3JKyGF7qTkx9KKAVL3W/Rp
+krswWNPV6/w+gM+JlHAvoxOHU12MDsRLUJ6hU2K+PcT6
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_ta2_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_ta2_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXwIBAAKBgQC3D6bt8ufSwd4JqVt9ukEUdqom/PalC9VCpeHwWyoV8GC33wYT
-AgYD498xuU9gHO0EVSgRvYt7nZhqLBjoRYWli85Mhz6RRt12kcrRDTYCGyMYTEQB
-pI4wAf4JqEYo4y7lX0Vm+aWBKvOXDcjtIs9ZgkvMxusUNUhI36hYpDyAYwIDAQAB
-AoGBAKdoY/MFCWXerwxM2YNv+iYZot9GxNQIrz1k7+tbo3AuxHRCO47UceXK1Qjm
-+6TcrxAgRCV9Hnqsk3681wZK1b0T0TUaEEiUuUVVtKAHBD/yHw64AI/eKmjMQhSm
-aw9WT35E3HeWjX4VIwXZjUGO5wFg1SK/f61FPrDwWCtnZ7hpAkEA2784BgNbNZXV
-fWBRXxiSKXngGacJdhMJAz/fXGeBho7t0FiKYMxsDKp1912mYteB3uZCmo2VuACQ
-IS4PN3sEfQJBANVDC/cNjip0ztXh4dxSfAJbqNKJ774MELMZuU5jCQBBevnf5V7Z
-njP+Hl09L+Wisb8+hIcslB7JoMkQ7KNjDl8CQQCMc4u7TCnf9gSePhHEVlAVcnBp
-9Pl3HnOEQC7jQMTo3DHkGLNZa08kSU9c696NDnFTppircBNhp/p3Opk/PMGBAkEA
-pvkHtTb3yGYMS4m/vTEXxwDc/XriKnpn2NKbM7R2p6ydDGcwv0LDixG71GTDy5fG
-c2YPfYZ5smFLciG+JW65IQJBANDtzr9Z8Wk8bV72jftgiND6i7oGO9jejZneKXVu
-y8/iwthkJHKjBh33WrLHUJG+NHms7zoSfstyZK3PmqGxyq4=
+MIICWwIBAAKBgQC4wRlCsSapMx8fVdBPbUOjVXXH3hhaacxisqbs9XgZMVoa2GzY
+SGZ9FdTa/t18QqCuItFR9SJUSX0WWM+Ctz5FxX7ahCj2s1yQYScOcP76bD8gCqAQ
+UJx1pAJi2GgmY7ohEIk5qxj6EHcmT6zxUEH8jPfc6SAZfCz7AsdAbWn/BQIDAQAB
+AoGASgpYrTmBXN13437odGw9Zv+gq/B9of40QnmGHABjmPUGPyvssuCQ8iAFpZ3t
+9RZefmrFqCqtD0pELuh4gNIeyfj+vFnuzGyFxs24oCV03ybA1Db/dVmScJP3myV/
+43EoI1iHidn06GcVVRHQmR2XwAO4PU/9Zuvi8q3M0hpwtCECQQDczYaaGFTbKjeq
+SbMGMJA73TCVh97gZ2mxWW36NrXyeJgA6ZT3y073kyiegMmLVzdDTGGGhxVXLCwX
+1wrg5LBnAkEA1jSDAZVdqOu+mMVcXyOFch4k36dlNI53Qqm+s6pzeSy/32fJzZgJ
+LVe/PY39DiEk7qrtEvTOZ8/GQUOlYDPBswJAJtNtC8OjiDZQO31iIYCAnEY0uNZ/
+dm44w5q6H/lm3RAfimmIbFovtJEH33c9+WaIrSjNLV6rffyidD64BvuvmQJANsoJ
+tE77POjHwJXCsccJLA5PyjEr7sx97rwyPgxcKuNqVH9cm8zGlCV8kgcOch3CL5Xi
+u9WIMf9wK2NdGoVChwJANjsQIBg82zIrQPVFxbtUvSwhTK913XLo7W5bfUwRNfr/
+APN9cYfV2oQ5hPFmNvacU2x0tndrPClLcSaglUWVnQ==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_ta4_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_ta4_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCsAG33eoa7z8gGmnF/aTpBLV3VZjGhL517ct8hRL4DY80+K/zj
-Ro3fVMtxJybPY/ibn3NeRZ+5Xnha7ebAIt2b3YpaTryv3XClHBJgHHpxfGWPQeBa
-+8cCmuHv4dWrMfsIyPnJ2PF+dVl5JyYNIUOJOmetE3Qj+icPtxpoZWe5AwIDAQAB
-AoGAOvI6vaGkIyFmb7zmQMATUtr1WXkYcSEcW35WsdQZOpgtcq0okctQO8WXo0PD
-rTeZr9vJcflyb9jMbn0xo49PWtdN+TP+NYL2buqclJL+nd2AVzKpH6ufRM5OeezZ
-RkCZKmq913umwjFV4SgeJ7QJWmDzZfaE5RsQDOlz4rQio4ECQQDe9KUbcJj9sO7i
-4wBSrVBwkU5HclaitqL0ohMuoJAL/qiI7uC0St04JZPctndoEzLDlLmfJhWRFpeb
-hsLLHY/TAkEAxX5+4LDgYMZ7ztMDg7xADCswqunRmGdQIU+WuUfDdAvXyzuIPigu
-hzKujrH4Fhf2yRj+MTTNcSqjrTwQA7qkEQJAJmbM6WUDdO68tqeSrqrbaAgfC39O
-HMiIWMpxs15EcUxziuJaIbOjVsBiL2neNzbXT4iWUCsnG85gXpFfi8yTsQJBAIFB
-BLDxkihEPwtht08kiZZtPfDeDrr8AsmKWU7x1M3CYn00fTqQ+cKqPOxPNdrf3DhJ
-DzQNJtgF3BGo2aJXKMECQHJxFZkCXz4x3/fNwWG6f9ZbcUczXsOt/+/WQWxKNi4s
-VBLQ/7c5Jaw16kt4hH4f4RSbAnuCuxDiEOhs42Kcl4k=
+MIICWwIBAAKBgQCVVXA/ClL1kKAAIhFNvwX3i1Utih5mQX9MvVUJ07pnCsiANoWp
+kLLTleXnKvaRtrM8ge8cDPuFkVEKdAWXnSUXvv4NjLSEN3QKsOD2dCB9LLE7wA4/
+/JwFJr4PQSP/2R2jXQjwM95D09Ll8QA9qsIkzU81zNGbW+HgYRGTJuG67wIDAQAB
+AoGAL/6Yp7oitYe41LIeS5V0Tn36bztvz7+HMVu8Y/8nboyZqhNb3AaEYtpPXH+D
+ZYuJiY3dEm/duqzclfZ6AaNg0wY9vIZij0zFpXF2cgiTj8QPqWro41Qzn/2HFC6Q
+hD4KjQJXGh4pC86/tEdkLzd/iJRNs/N1j3zLgMKDOoaEvuECQQDGvO38q5VaNG/l
+bQvLt/o+jJv2Q98ayhzC83VqGDW/2fof1oKmwvimJ0yKmGVyMvbKWpq/HB2/F8sw
+bND06qvxAkEAwFxpcgaOAT/SIXGdDd/4Fl4edmwlPcQAUbexXMSng4RnqEXCaEco
+a6AQkaf5VRNdqEJBLDJ4lqnz9fO16Rk03wJAfni40rS2pOL92njcqtX3sFp23e8v
+SbMZPo8ER3IEsoSbAivWlR06czJLKV/2HwiDuR6Tn87at0MDEVwOVe4JYQJAXzXe
+YzfnVar3IOKRL+rpanjPbyH8FORMnCXlvdsAZtJEVD+jB+YglZS2XsHbYUailsOk
+anHYygn43IXyRhvZ1QJAFOnL7zZlxoT8G95RGazW/nL+I8TnmShHTUsqQ1NoUwBS
+S/aDFuZs29z9gdLfmO7tZfsO2RSt+xTs8Q85t0xQLA==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs1_ta5_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs1_ta5_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCnWFpkSR5l6GPXbNK0ZXNHFhAbqUV+Iv6HezBYLoF/0Gm+SQbF
-RCuNMgyRj0jU2eRRJVJWvECSqAXnZYLEeUmsQvzUQXGcy3rwXzXXCBEDO9NLwcs3
-es1YZOwbgyU+OvOZI+ATxYWaGtR5U9IyTMlQOxlmbyL8yFpr75fZdwE6owIDAQAB
-AoGBAKMUDPKR9tekwjdbS3KVMuPhck0ihiBIBfcNa61jlLtz5LiU/c4bgr2UOn9X
-PMiAlmklj7oKtnq01xwK5oaFE+8A8eUslLDV97PVHBmuzs/4ipSMYlB+ZiNNuS2k
-nhklGLFeeFbtydhoE+VXAu8xVO6o0bX8VHxdA/1kcOX5d+nBAkEA3cTUSjav2ZFB
-glF8Q3XssJexpkA22LvWyXdL9LgC+Y+RoJ3q1nKL/14TbJ5tC6PoauRrJyBJzmPn
-w/zqBKL6kwJBAMEs+e9qExorxCb1mHIMBoE/7TrSLhPO2RAbSjS6WItCD3PkNKE+
-j7kUTIrbFHu5aVRYnOphcE+Soi72jKuj+bECQFW4YyZchRRf5SZuQM4Cov6PZAeT
-AqA72wX8qsto5R15tRyUbdV+aUbIIlH12siJDqliqVhyTpUMYOWMuRgZtykCQDm4
-NJ3itf514VA6xegdy7vG3B1dO8NTZOw5Gz0SCO7jODbKkycyyELm29AJkd8+EUjQ
-iWJG5wX/rFIX/QQ0JKECQAvgKwZPF9LRWadgMPCxWJJmWCsTW8e17pGwI3i31QjH
-thT7ljDNnx3+Lo1vVjIjX9yZXuhloJsSZkXfY9VQ2us=
+MIICXgIBAAKBgQDEI5ulprveSKC0Li1UT+dh5J3frQF+cFUSNTbUceUf/gDZDxve
+Ylcs10ZnKGeEx7PDmWrsicHp0mCoSNEGyWjJh9aCiKpMM9ZgpLsrOA3oEa5zTLcp
+OSRVPcJksFTojWcfeZSNb0yVzdYAn8v2kL0HUvH+FrIlDklAwM9mPJ14iQIDAQAB
+AoGBAIu+6xjdcSFxEb8O35Eg1TT0VF+Xvma91n8Aly5Kb/uZWDVPBIYv/vid8TVy
+nj8GolgMqRgbFqRoFiIQr41sV1Fv1zHjl/URlPgQ66lDanEiw0qhuFdg6R4JFeQr
+tB7m9jE31PoPPorr2esESxtcSoLZeCNwkRBEwGEE9ak4IKr5AkEA65X01kEo+TZF
+n9bPQ6nwRCCxWFm2NZIwPHf7HO1FH1n608KE3jilhMp+kVDb58O6sFP85uBXa17A
+jAH74OoBTwJBANUimT0ebezW5kzKg3/gwfgYeq/7X0rAwzfPID56sTfKXYMaqpAA
+ANnuk9zR1thEP/iC+1xKdSZZmXknjsvMAqcCQQCV1ZAc3OCEcEIkAOld7a2Ehw6E
+VLqQo+PN8blikn3ODNp86FC9TWXoaSnKnpTeeRw5nZFR/glbnq3z3icmy239AkEA
+nkPf2HO1Gs6FGvayaQ3j2y+KQw19OEwlalbC0cJXwF7jy4vMpbtq5mlzoOCtEdC0
+U/wnXOPpU/3qqf2G2qx2NwJAWx5yq5IcXtdHho17oVaON842pVwSzA8ZfYmKzMuY
+1BJT/ybKsfecl5PbKbbgkAVLJPe+26xvQDUDw5u3YqYdyA==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs2_p1_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs2_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDEM9UYz/KC1ebAaFo6KlAw/NbfYczBNRbNIr9yQioIqpP4Uhjp
-5EXz0QqiOMZEc+EnhJiIL/iyseJGOb0fz3q8UX8x5PW4VvNUTKVXrnDM9qRGiyx+
-02+bwrvmpPIqFeFIVCxj/bPrnm06vcw9zj0WUsFrKoKMymBQbdaqiOfFKQIDAQAB
-AoGAWwpaFTtYolEy05EYXOkJcNHBusGcywIhZGp9Pz1oV8EfDBi8Krubofkb4A5M
-IbNLhJTIWlk4I2LbRg7ArSQPJMagfAbpuKcpJdsj1e+YPEvkTQBYWPaNr9G2fnHq
-/kWlKwZ13XpMG23PGmeMliqqCml+Z4DGHJ6TFhTxIC558wECQQDueVykLoTbvl77
-AQwmKirXPuxHQvDqzX1l6NmgQJvtFo1y1DkSlD4CbdpK+hNihUdnVj6yPPmVOwT8
-AX+6o+9ZAkEA0p8sypq4+JLY5Xgsl21oqIqjWO4J5wdAsoloCIl7kP+GGco4FVHW
-K1tAiajrI2/W+K3SP+Os7Ze+gWnGLUoaUQJBAMpRunAsa1lHFKvdQqJqafg9kRYQ
-S/bZKcc5GtFjnyYxWQYP2O/TRxymeGnd6m5OZrrcJ8ruAk1CSkNHPkdpZ9kCQQCD
-Dg5l5w5Phbg2WKeOdcKYlON9M2iv+4BTV1KHdVyQ5Z5Ar+Zjxa84/SfUQGpHe5DM
-3gOkQ3vXvwMILZPlnGVxAkB5hqYYqQOkh2uStr7cFC3GSgWWRLGRPy0KyvMBpqpL
-xSFAStuunpykRkXWcqAjSdJjCiDEcmPZUHkvCQk3RH+4
+MIICXQIBAAKBgQC910srcsYLmDs97HI/ZHi/osVHwSAsLLTlDiy+qnzsn+rsBiT6
+4w1kzkxZhEzJZUAf0HTeG5BJq3Ait5uuE5jfZkS0LIKLyENUwOO/cWFalk/vhvfg
+1oRdgUAPHdUlmPsZUktAOT4q0i/2FX+UGRlE14XEtZ4q4uPKjaSPhCK4DQIDAQAB
+AoGBAI0TNts82Yu4Px4PXf9Z7JmMnkpqbDwnpO4rEHlIPLmjRXLMRiLjJArre7Vy
+KZXoVjTONmrv1NPKQPSruVctXQYuEOxUbsbCNKJn//rp9R5K/RxpBP5Hl1W7thKg
+Dc6LaP/EWDkfUMN+yk1fImmTZ1k1ILCanhAJA0eDgubs4kZBAkEA8LJ28dMyCOIZ
+huoo9EULN143seIzv1uvmeFRmPIVytwUs0uuB0Shp2ys4NtlO/mgjq0CVQa8bb1I
+blv2kUeAWQJBAMnpGvXkpRFEogzJ1ViD1FPAR212RcGF0Rh0teWE987sK+E4H3L8
+ujuwj8Vyht5L0wXA+wDmQ694G1VRWjgentUCQCQmeazaTnJ9Gt5jfuEpGYUoVm8W
+DTWZXKdc6vdwrIs6QLWpESswSKMvtEtVSEAYvt+O5oHEsDo/KojAsSiit4kCQQDF
+KCO1W9B7LiN2jVcQGZopNaYJkuXGdF6anMxJFC/OE/s87kp3Q6SuSFf7GzvqsOub
+wLbYSABrxMIb61ZHWk8JAkABradjtQJPMiU45QyBCP0jjssrIMiseKiZc5UV8IqQ
+f7lSsW31FQmPsO5NivODQAHjOkl59Od4r55pxHRB9pG8
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs2_pubCA1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs2_pubCA1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC81B56djYkEC+Es+0kjwuFihc5LxUmCoDiYKrAAK/VupzvsDoJ
-MeeXN4LqMqDFdcMOD2p372Z3L2qiYFu3hjnfEpROYXne3dL80aC6/mokCTtPHjUZ
-4hUli3wDGWY9EEWRnIOaccmy69+pZMctWpMj013sZANk9DS57kAd3wzFPQIDAQAB
-AoGAFzSiQj6AzNHIZTCPdiy2J8UesYJdwP0NdcSXd10ePs/eNX6cw0CEy4qg5hMu
-utWMERBH71FWcFM9cZMR8m3mcpNlFLVwUyC9MzWam9XCZ0Cyms/z9RjEhMpTRUx1
-zNLltnIcApf10h45atqMlXE19bE6+RDcpiXHzJgNdeIkpakCQQDvFfWs1aJY5I2J
-xN6KT7WgKUjSujnCqV6dZv0yLbDBifz9q4vIHxqVOfQG8Gxi6jdyBd9EM2QzLoXd
-zJrpwXNzAkEAyi/11hxNxtgPMxOxuOEfKoVr3QhqHLMeH1j+B2qZ47nSSjd0cNIi
-OOkvvdlMAOWKkgSjB5nfPQ2Ai3WMQIuYjwJBAJS/btgXGiiAGecrCuG2ceOxi9M/
-dYw839bCKqk7cAsZlMMmJZNedqV9JuviTSzFV7WjHaNK7f5B5Zt3HrJsXy0CQCyv
-/wDszo/1bx6V6sD3GOFYDegTlQh02mKJU9Qlzo+ToZP/v7+z4hZ8C65FWdQU59Sw
-K6xhaQLgehnYyD/32qcCQQCzqGsYRAalVuKVR8HBq3k52WLWK/6eSj/pjW1Rei7n
-C2txZgvI87OGV0KjSOq1XRROgOTH40CYlB7RsKzAU7J9
+MIICXAIBAAKBgQDRHtQfjgc6T9Mjx4Aa6heHazjU+BybHSLeQUfQ3WWfY5KhoKRY
+IlPdaL2GqIijqWQV+7J1arvN8NgRQIDOKlWPFdSG+SpHgeEfiQJNzn+aNLOHCNP9
+H9sCCZzG5oP2eXiXzKroRwvS951VMVDkrtYksvVXvw52rvecwARmsD58TwIDAQAB
+AoGARhP4reJgla/uZ40RZvOPkvfhgazrmSd4adaihGHNDk7F8pfsuwQ16nqRGLEd
+qQq42Y0RTrvH18mf/pgJEg2pwb+aJvVvWzBfrujxOhYC0pMVpQ3MpioH/WUrVyIk
+U1YS0NDc22m6zBywVIBST0QOtL3jSuHNb1ywzUe22k53nMECQQD+vX49x7ukblAL
+xx6EscuF0l5M4NuER7ZO8RhBTelEIa1WOTT1LXsTS783GRnC5lwHDdLXOP/VSuGR
+j8+6dc+RAkEA0ieUbaHnXybdeD2Y57E4AydIckLE1l5zsoyUQtYr3DxINT3Tajpo
+fyiQfcODIvqddzF7eXFwHILcg1Ykhkdd3wJAGm1wPlqNRfbHySEEMoH7ekujytf9
+DhEegbwTZxr9GztfLzXKH7FzNkJCeSXafVTGsVimyfs411joY+CGjXKRcQJAYy28
+tdSvzc8YvBNN4yJWzd4vKYVrQcQHlB8WJUjQIDru1PmdmceA42nwbvnjHJHr2IGo
+xRKNF1eG3BC+YgSyPwJBAPFauww+k+tcOW9NMDhx925o/DWs0XOPmUmDDmWEnmRf
+2Pqafy4IXNMCITRIsmIn50PGkhBI4S2KphOt0cGDYOA=
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs2_ta4_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs2_ta4_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDTEfJWwDbvrX8YU6cpd59qgkPNpmUMXso52fqDsg0k5RCuhcXc
-AqqmOE8x87arRzeb+JmAbNM1NoFy8ZMPa93K112hajB0bgecR8M1afw45rU9vGXm
-rWfqIpAG0+uqZC8+s0zhpGUUjrKWhfw8HQGlShYasoTpqAPRCb57PDsO7QIDAQAB
-AoGAQh3ADL6fNsrhIgyqM0oebK2rcZLq2kojDKYkW/Z9OY5rgE+1H+rR68l9vUb7
-dIGVgM0JwHnWWzfcqtXTXCRMz/gLWeWr7K0Jt4X1iDXEKJ97lCYyrQcJ5Eu28S6+
-M5A+lEBicNK5/q7rcu/mYiFnVU07pnVDsoeOjS5N8AeQXX0CQQD/SodcXmPmSWQv
-804oVT3Znr50Bo7PEssvJFcncHfEyD7tVpORXOerodD75C2MJX916ptOK0vrr6wA
-4Q+GPFFbAkEA06f72djec1ZCxYIjJZ1fsJgarRvNUOjNBtvRuKKGWrChFnktQDN9
-2CcIXNklAJlscLVfIftehW8bwjUeht2LVwJAa5cZXRBawd8EXkEIG29xVZnVYkix
-PwwInaGPKYv4rfJGsvfd0VF6QZc84CvWFk5nXWa2dUdCA95Rez1esZASKQJBAKTi
-tbnVUB7L8YKKSjUwb25UYFvBT+abJbYVI0FSI5adCTFHv2/HbV8psUMbys63txnq
-wazodY8/qoFV/m0UREsCQC2i+6Y3b+RDvWFmdwuuu2+LFNePB3c2X+YC82awEOa7
-EZXiK6Q+a9dTAGPeakDJHKpZdWg042clIWhkvEn8lg4=
+MIICXgIBAAKBgQCXVrkv3lOAfyLGpynOQF6Fdq2HNjjyMWaZMuA0Lr0QqSb1Htwn
+bldOnTcbrRTSumBELBOy/GElM2+pntRKUigWUT1sOvFDgGvBaddxOm73BIquLpVw
+KvzwJVCdxr0ES4kcriKDy0Uu03t0xJJ3/79bqXOZFjDJJsIWucJjk+ZbpwIDAQAB
+AoGBAJE4J5V2anwIAy/KYkRG4iyBd/wiHLzSiJgDCL8qBkRBfF+EEE9KAz8tfx7w
+k+Wt8Agan4CFyxYuaDzEawMyGMHvyrNGcg4IP/rXcBXzNUMauVrdT/yXeHXbLXzM
+p9H5F9sYPHpvuTV7jds8flzrmT1w2jz3nV5THHqXKxocd82RAkEAxglBLH1woqAk
+hFr342VZANjVu+sBrxo7BR9S0g44EFqqiplwBOK+lOE/KVw2LXMW2rBtTIRhWjl5
+2WPmMXUdyQJBAMOidTrTqh3TJ9r3tBanLRD1pXAquRh8FvG/WfO3Kzk3R1muzXi1
+A3+SJFYpI6tU5hFVWIjYPnyRWZVmBxr1pe8CQQDAoVfn8syRI7zhkar2YirFDCY6
++ElXDejC/skM0g/uuIKS9tVjqzs+jitmC/AXHY/pgRuQBmS74pSHxQiwqv8hAkBt
+5YHzJNoIXQijgchhfVHcmBFyXB2UOojtDm/qb3fRcVMcdwynhQ/NBvxwhjWqVkvT
+at0MKmWXtlLbkO/m3h1zAkEAmp16IZClM9P4LUwFsAqZ2MFmtb5sjsx1ej9NH4ol
+8oVrkSxr/O93pakh7ZDNUj/yB0on83y6zAzgxfA7F9RUKw==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs3_p1_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs3_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDOnqqaRGLknfLN0e85zMu46RoGz37k4ZlS4FoXqXiz5yXAl/hy
-1HVQxdmEhJDMU15GwGbYCnYMz/f/+P3p9GCISXSXPTTwkNqXXUAeeMu/hBvCfnDL
-tnkmfWKhY2ALn7NaXxOoHF71OQwU1GdYFgk7z1xKSuYXgJBptW2NyCeInQIDAQAB
-AoGAFhGsdz3GslSMkp9RxgKx39ZGCWQwUZInJksAVHathcmyppeU2e8HeNEpIpZm
-QOzGrRfv5DN52HR+MMEPneWUSckQVPr7PFwhKGQPDwRK0M354nFB+7bfUru0n0a8
-R9BeiY1uCHahaaRSWydbaT/+UEvH+Oz45ypx7L/Krot2hQECQQD2IMEPFNUNd9Wf
-udsLswDJLmNjguQ1LR2x2FJvEl//mXPC+60FDzUAVitTqsOxnrTWlGFhj7BlBWp6
-lhZDhcLFAkEA1ug96/8SLJU00pwYAMc5SeV07uG6IA1dh6/w6oS6FXuMpS21SduX
-DUOJLylk3wT+jpFRw4dnRxihi1HSk14r+QJBAJO/U8Um30IndoBchCaAvO8Hvrfk
-wfM98v5oeguc/y2jQz9/7vwDhfB+yaF+99xvBeVtywtSwzPRTXrrD9BWwnUCQQCV
-q9tsYBH9QNEwGQxShm2svITK1iS1q/lGxc9I1bVvvsM+Su4miSvTTgTd9rtM44KS
-Mj06qzPPfSUNDahVgFGpAkEApfekCGNhaW+SMIciQrOEsaP/Pgy6UVboPkFABWX4
-UIinIlogtzlFzo0ijrqt2yjluq62Ytr8rOTRFfoJNJEz/w==
+MIICWwIBAAKBgQDNkFFN2FleZx0bPba3HP8Fl8USN5FogRErhc5VuHqZcsNTSk62
+ggF6RNG06hLgH2o2XMH5VqTLov9K2Mz7wRk6DOjAOqz10jIcTi0WYN+Erj57tcNc
+rNpaubxhJcHs19/5NMBf9EVWoaHzQ+GsYSTH7rqJb/o2s306sb76sj9TFQIDAQAB
+AoGAfZ1jEZ7TfcylDLB5pwwhCtnjo24xfRrh0ybBH8DLqllm4s7VqtFm9cB4JYWk
+YzDPRskH/8Xijk3ck3BIUs99CdMpYj4jwzWEYNUivmCnXou5O1pi6+0RTu7n6aBs
+4g8evU0Y6rmAOzkXtiO7QDHAJ8kGfQZYjLA7eIamoYosrAECQQD2LDGs3zZZG1yF
+acmok4/jrUfip+FhrtsnOeYd7LEl8Bg8VDsPtl9sQNEWVz+xtM6aait1+3bDbDfM
++KvCRVPRAkEA1cUdFJEWwisp/U9/1joqQzRkR+tEx6i2FbAKrUakjghYjyOuiuS+
+/6pEQ+442ZLKHu+tKM1uxpeNXQ7fczWwBQJBANYqbK0xJF8xZrTK7B41AqHZRwjx
+dSs+rHrb7E9sdFHFJ9CUly18RFgxq7X8AfXgjz3X0Ce8tf4eUA2K6iMBnYECQCmC
+izERM3Ak3ZR4uYQp60b9h3OHteVnV2RCuPAIxa9m43t4HE6QOJ6Au5zNR3DIVkNH
+m0JPEfGyQBsP5kgC5tkCP3gRekHb/Tdnl9mFE1vwqEj4VVKJji93P2i1It7iLCzl
+vgB36d7fMP9nR0ubno19AoeKf2+oQ6kIoc0ROJM8ew==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs3_pubCA1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs3_pubCA1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXwIBAAKBgQCuHue9VP50iOA0DTKyG+o+Y/17GxPMhCnh+H3EnGWqOiv9yXwD
-VwOyEnW5yV4CpI5tx1TBzeEwKF+oZMnCAuI7r16z7CwcXEhQB4fkGYDvtHhv8m/d
-ZGGXzqcpCgc8by5E/jhwW8ZEu8/1P7MgOzuB+nclqx9P9tso/X+6L1cYRwIDAQAB
-AoGBAIySqukyK1SOBORBG4KsAstoEodG7w8YTHABHBiVY4aw/D8iYZqYr4UeXikm
-J13e2JZMbWMiAgHNNp1O8YxOo7HS6KHmbG/ywj8eyN51zbBKjNO/oYbGh+ItQytP
-vqni54Solj2KsQax9Ke7QF82HKSN7hvTm65486/1wjjXw1oBAkEA2gsVa+YfQeHw
-63OYOL8rhD4dDZxi7829NqnWf+izpg9hOjpTv2yvoX76PaToKX+ISJuS43w/8uTT
-x+Ei5tF0gQJBAMxucvNH2EbufuwLLMELlxzW+vBpqRP2CoH6W8lAOxLBH6A2jlP+
-Yaf39wz4cadUK0Qq+QbAYgX74gdw3XghiMcCQQCOadDbAZoG2QEXeA/DeLF+lWc6
-fZttT263ZmSwdJfp7X+unWwXynBIRfxCCRSODjtAWUSuinfmOKlOkvDN256BAkEA
-t6DueECssOpB790J0k2K60jgF1uRmHCFd8Ne9yNO7MW0lsDqj+AL8Ej4DRqNXHRq
-eMzw63ObmSxsF6r2BJZ6uQJBAJttK1t1MoB/DbrN5KekckC/fNuQFSXLm5xmJMMs
-tTF1vwqOVBVKHu/LWylmuo8J5KSElE3wrZaoeDXNbOH7ul4=
+MIICXwIBAAKBgQDaJqFoZuxvf3yUlA90F1IOQYauQ0Dx6sCv6FEDloJONdREoA0N
+ZytEv4Fch5piQlkOl4F1NW4YZ36VQUdcUfZaJ9y5KirqW2y5WXh8+/9ZZ101i7eQ
+cSlogMiwrTdgliE0eSVBIPhA5DKQwBaBw7NHnwK7FX0ybV11BEXPI7WOlQIDAQAB
+AoGBAMdAL37fOycfx1ch4PeE8WKqAOyb6u7LHxHMXGqthvkOe4Huud07FS8mx24P
+QThsJ1GHmivHEHbj2J9Uz2wIRLwk6oD6WQFul5+mWBCvDKu+sqDALWNmVy4Iu9IP
+7fsOsyTLqcdV3aFVvlAnjwcwW/63VSeb/xYMAIYuZyPSoTOFAkEA/u/hqI3tmWP3
+dKPQ1SPH3X4s7fCa5LztQn2XttXngI6NsCzjnjCcIGUGnYA9BpCKSyjZ0OEeAvWP
+rJoLCQ1SrwJBANsPe9KbE5sbd41FPWST54mYjkO53ZznW8NGMn/w8JXt2bImxIV5
+bh6hCEBzVUVcdktNb+VXxH8K91+YJuxFk/sCQQCnXrGVyWgd9kV1rD7kT5Nd1QKG
+TBpE5cwWhQHfpVtRSUW4TiA5sMwvcGQBbzmhX6+LXIxz1/euFa13scJg9QA9AkEA
+ncqmb4rC8Zw0Xm88jME5K9TWzRQJ/OZuI9fhsmT0d5rPj9L7BgX0+10VW494IbE7
+iHxsGHBDGxvkGli32MM5lwJBAN2VVnxGgNHWQqqVRKL4bFjFDMh4VA8TdljowV9y
+fjWLROYvL3gnbYwIveWgtACKWu9XHXToX/ZTkquOmG3i08Q=
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs3_ta4_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs3_ta4_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCyZlYuKYBBsfQPA32UNX1nX6bfSchH2FMDC5e7Afu6hm5b8fay
-UP3GSo8WDUxrlXJVoSbB24rxFuUGRXJ4XFT6Sz6y6WipaE/IGY1AwQc7grXqYHyP
-lJ8ngXkeA/GskEJrb4ce6rmoxbGkKv+MHDeqfet8cCpf5lZghEblojsReQIDAQAB
-AoGAbkoeFUPK6tJdE7sQs8Ot126m93vhuajfCQ7tqss7GMFrEKSx4uN3QFNvyi5G
-hGxL1uxdzZMwfoOs6wecERTj4yDMdk0d6aI0FgPJJVEzfLg2d8FzAKrC27myzpCh
-LO1MrfRhftzDZxWnVghsEj7vA5qdIDnR6yXKl/AI7kFkiAECQQDWcolRC7Hx3quc
-332KLjZ4MR4nWov+h4rk34XLvi/qAofqXrsxXTgFuWB2TMHoAN321LP1f8oqBlUT
-XtIntJW5AkEA1Pewn73mc9pgP1GhyYhiM+wxmPrGg2R6vbfYi5taYzZ91ham6cwG
-pKIh/e3WmDCdtcPxQLMYmyRpMNtZS8A5wQJBAIfDBy/p6YOoZpjv3DhovU8mOWLM
-rig7gzEWWUv9YbQSWh2ET5oW2+qzy1/ZhEDum5cyXaOkfUZRr/aNZxp/9vECQAW8
-SfhzX9J87hymcSoBT0vAr7FEB7agLSIQ4ncYDv4fCJKMd6BSS1eBulKhZichIA42
-IbgxWpdLCr4zGhuNKMECQFwhLWM/W+nfwQCe/n9VO03xvjPXKxoJx9dmuWW3w6el
-NS2WYbGMgXSZNTlQ6Hcu4Ui44rS2qtfZktxAvhnhrV0=
+MIICXQIBAAKBgQDfMODEnyZE+LOEP3r4qXalRwMDL8lWeJU8ClfaBi1Fv/2zclzp
+iUTHzU7eoccCM8ImTgY0d2JehS956ZuR3sIk3Ld8s53+QWYmbI83MdFD7uyLuriG
+OHqdeWWs9sr+qP82anxGVIC3kIL9h4WsGpoNgS/4+03TcqOGWoUPIaKUuQIDAQAB
+AoGBAI1N0MArUntQSbdsyVotUCSLtOiLlJjedv0wPzaVuovyZZj6ysBAW/9ziH+D
+RQ+r3TuLInqNKwZUpB43PHs54QdugsBxh6fCnPVB410SYkocGGbLkrvjFPgUVcc7
+Z4ZIYlptPOnPxnHb7v0PE/u97zRISSBygbe1A6H3HA+3Jx5BAkEA+qLnM8G8JE8J
+ZBsSOFoRUH6/gk1SzuvphCaRlPRSuImrJyZxAPcFVdxHQ9zMHUlVRpzVZmc0NW36
+kUxern02bQJBAOP3neOD8nvUjcBP0pu8qterdDBdIwnlAx8kCUjrg+84pHaZPR+1
+nZUYoE+/BQvVVVdkRKeFP3dItB65JzAAF/0CQGbOX0upkgTKrq1zNTwMJcIA24kV
+MnxR5E0ijOCufyfWwG+kowGkUXnwiwLZFJiGtgXq2tXQS2gHHppu2v9zuNkCQQC6
+ee38kw2Cf89oVaNY4474lnaXrUghKuVPzuGNdaHZyIK3xQf77Us3EArq0L2m/V4u
++4UxZ00QHTfBvgExQZJdAkA3TGUEPEQhB7A/QZwVy8EkIGnEFWUImFZe88RiKypJ
+1H6adg8v3iRwTq9XE3254/lnE/WEaLXE4OKMsNnA6Co1
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs4_p1_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs4_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQClcmzE3N8V9bAv+9Li2fIsXgrFBDSZDwYTmuiGLUQvV2eBoZMO
-zbVLyhpLMcanc7NwZiEDas2lv0ptlthQnpXXQoSGgPEVP1yFj93uE2HJLHHBwcvo
-6U3rztlXmC2TgQ77bQAxndtvwqqxNmUNjYJ75998A3b5uGxufhNdhazAiQIDAQAB
-AoGAS4hR4A52SrBAH6f4P1kBFwBYKlohKT+SpqCyR4+i8XoV5zi8yqVff5plJq8y
-4oAQC+CUcdrwyBrs/9s+JpBAF6oSY6wNv+pAXkVj7zh24mjZAPBqV6gdsLZ9gWVS
-YSPC4df0BisRvCCQxvYxzx+f8jINVIXGDdEuz6RSLDbKC4ECQQDb7N5/fnXJnZD2
-TIlgjdE/jMOl0QUfcjdrynl5FY3b26LCYfaGlzXJ7LGP/tceo0gatbw0fr7x36qo
-zzeaPj7bAkEAwJXlWXYUcIqWXVBTwQNhEM0Wq6B3wTAYbITxiW58jrb+oatjnt19
-t3fXnbMaoWU11nnqW3lLR0NhYFbmDF7hawJAY0GSYaQncOkGJcMBNWyMBcx3+HxP
-fZPE44csL7PEpHeKC4S/CJtyEUIcGUsAt7klr7hZyq9xaiRyF2H+TETPhQJAEWG2
-CIQCxkGL3rIwTPxcF2MbR7Q8+r+3hJvfHPNO5KaZhsfsPttozFVRrZcLsUNsP4ZT
-Y5wn8i+fq01MiBNMLwJBAJYLdA89YS7tAAcsuAm8g3JofzmRS8Ty/FEBUa8bce2w
-fJOfBvS+8fX9Zn7ZRmgeP24Po07gJGTPDr6D1H3z9kc=
+MIICXQIBAAKBgQDiYAhYrw8bOAeMnbaIxZk0xtp/N2suc0zUTZbIn2ZhTMyXebiv
+aFA6SnjRV5q0800gculd65mfDQSp8Fs/NCm4tSjh6kOdDu1wStFSE0EsEGxbvI9l
+/zv8tifX6dw7+GLVRYWlwbc9Gfl4eJCktqVC74L1F4CAY50tUSQ+oU/MFwIDAQAB
+AoGAPvV8fMW7StOrbdVTNfjW4lHH5QfRvGp+3LDzlbqXa8pDQIGu9sHpRjz+GyLl
+ORxNwA+VjfR/lje1q1nY1tw4GcvkgkFsUbWJ1canqzUB+TuUr5A2uxXLGucX+n/q
+mA71u+bZsDoImSYJIciRspS1w+8aODSP3VuJ6M8sWGL/E3kCQQD8DmnZVOPw3yvF
+aCN+B9HE8t0E63673fGM4Je8zEL5vw2JMC2O3sKI6c0fjkm3aAACFTZpvcbMS3Qk
+Nsm3f4PrAkEA5erBd37sGmV4IUbxI+CnkCuZTl48SOmZlvx69Mvh4foE4TxwqQme
+uU9+J56weELUCxNjbko0ghRMmxEqXwcJhQJBAPoUVuLhffKbifMnmqdNnMv6Zl2e
+RTSiRSmQIBya0Qy3iPeHTHxG+d4bkn/vjaYh0ng+kakiOF6zsjzH+yVLqBcCQHeO
+VmIsBtxHDWvIdxZf+OI4ObUNva1wg6SGz+1Bo8kdeLIi+rZ7wSS9mG1D0KIIpjjI
+MTklrx5BLgCosW7Ouv0CQQDk9mIDmJ4+fbnFptf7roTs3dZnvtWkwFisfP9Dy1YQ
+V7L8/GfuXDgSa+QN+1bmIHPrfluXCq/cw1s9+k2Qhdnb
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/cs4_pubCA1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs4_pubCA1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC35mfBfwieJwAAzo7kW/Vl0PJOrNQHuCGiWpu940gk//HsBUnC
-NFrK9ZuRKzxqMeo7JVPJCTsrJDKLjEwwlXjpfPDXvPhOJIvF3bRQWqhoeBXuUnNu
-Wpr53Xw5kPHvv+WlGNzU2KGPLmqcF9wgk1nmxD278qgO6hq+qVR/ontIcwIDAQAB
-AoGAQhLzto8pDoHeu2t75cqwmht/5Aqux/M9inLZwFk4I6seRfoEbVWYRZIHihop
-w9IZYZTgzLuXWcHQs1j+Svp5jXXWM/XIoPiN5EjvQfrIS1f8RtQ+RxAQ3lBgio7Q
-h9rTuNHmGAdy1A2q90PZ7xC0ST1E/tH7YMsAQO06D7AJUpkCQQDzbdhitOztfDMQ
-qhYIoCXZrrTUXmAZXslUFYEtSRCJU9EnkYm1L0nkd8X8ZwK6BjYHJJjsWl1HmqLf
-4zvOuyGvAkEAwWWUlH9XPlt7jEJqIm6mcPaBy7IFPQG3bqhzy3adZt36dHFFDiDQ
-KSinIcLRm8F0FBTc+jY5VVeckeMmFKUKfQJAOP5O201g63lYu14XKo3UTtMIo3A1
-L7txh65BQEkLBhwJrCn3A+S+eC9Su3WivcsWezWmWDAQBuO9no2lQxGtIQJAOGYP
-Nl8MajrzhKu5l+D82OSKZYS80lW10Kd/XU5yCJWjfGGr6brX+ajJVKcjyXBZEaIj
-7zPw9FpgZor/h/W5YQJBAIK/WuyWkvVrxD2ydEcBMPcHAHDnv/bSIIsv7L8vYODi
-nUnAblJlP4X7CJ8nO9OzChAeqWeFRyCDhV/7V3jV1lk=
+MIICXAIBAAKBgQDf8sUNEpt3yQ8DB9uRTmqU/VD8K3irrUDrjdT6QpleaEocp8qC
+2ksisYEgt9/kxt8/lVr9A45H/IVD1LFT0c1r64JH9iE1cf7awStQ12HvfmDXYT5k
+PzOrDogPQT0VnvXxT8OQ024WMl8zUlwtikPdI8VK54VCKQPuEM2l4QJzYwIDAQAB
+AoGAc4XZTnAN0NHfs5GHG0LXSjoOX7bRDcZW2ewVNG/Mi93CdVu85JlU7vWgBc+0
+aGCKY1NZV3FRISNLX31FaFau3wh/keEvIHeAMkU87pPuZ+9bhqFgszKlYLzk9eBC
+ZQye8ffu3Aoz4OKJaXwPri2VRCtFoQ0tfEfK0BVB/dhCICkCQQD8rKulL6R24yKb
+wHRnolACepp1HMwtt1Ap1y+Wiarep9e63v1530/wH36Qp5m9hikCUXnZJIG6N3lt
++5LbCf1nAkEA4uVQGhThCgF3sbedxLX/3gLsHEoGuJqsCXzK4QAdjt1tAANnLAh4
+Qoyr+BbN/dwb0q+VRgfufGuyTClaXGjgpQJAEmvcT7y7dtd0bHqJggy5XJTnseYZ
+lLOqqoI/u+/pfzYpajxbqoj3YQBKz+0ILmMblkmuYoBg3Nyyg6w1trZxvQJBAN4r
+hB/FygUuIrHWBZoUTBJr8h5RLfudGE/B7jYbEtZNYuncay3mrTsc21b1nYax/Fx0
+qUoFgjQ6kD+bTmumFjECQDvJyioAREl2fHkdL7rSZSjni10l4JbjYKpsUGVGXbfW
+5J0snNcyvXK/MR+XAoT0H4Groc3FumBl0ufeWmj7oIU=
 -----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs5_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQD2P1fkvp0pd+XfCHK+Z1zGN+etYjMidLvygvYd8ULsVsJu0Lzz
+5qaRodtMuCfJOD3J0+B40FEjIrI/b0seFFM++1pY9vr5z8rviTTNUcHuiTLEwTD8
+Y1ETTbRV/aVs/eo89+qMfT77DQ73cMdzzgGYd/7bHxwy41muJrEd6zyDUQIDAQAB
+AoGBAMJeiXAjDUa4PxfnQTsNt2s2oYZ4Jsihv+DSgpZr41lNujdiSGN0wjHdwo4y
+JiVsYUk4Fs0GEaVcM7pijLZ3cKSPv91ZM+QWG6rOB5XyhwpFkaea1g9ZC26ddCKh
+sbXJ5oVIsxGhhPrEPqBfYk46B5MyBuMj6uPUQLy7bhfoNwABAkEA+8LGBTKy4kHE
+AVNvsJ8Xf1lSW9W2Nfs5FcLN8cjV7RhR+B5ar03Bzyl/2lCcLlpPirRObzqxS3g6
+5aGVEjPDUQJBAPpkzdbnhGlTXMrYXnXUVq8g/YsHO7CsAyFuyNEUFpPkQxxraisG
+kjl8LItlOgDq6KK7i0cQ0+A1iO3O78LMwAECQQDZ6NNm6mQFDHFvyF0zHfDDrHdp
+v4fwH1tgp3WEIpZvmo5QWU2a0I3BFqVwPDeCs26HmtsM0Vtl/FHWMk6KK72RAkEA
++eeb7S36YKi7xxP2CwHXVkjF5HleoLC9GyQXt1ymQAqk1Ht8Zd7UGB2P07w/DOVn
+M+ucUVxBKtgjhr1vXGvAAQJACi4c6ToeBEjoQF62zeS1EqTlRrQkGECcyvL2I/3k
+59u4Jl7nN4d9c+KIHELBVOPhuhZZ5u1jQuRPJKQvs9EMFA==
+-----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs6_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQDFbG3xKEtWXc/rCCimhcnEGub5ykGjgMZSY3hDI/mcwkp10f3E
+0h3ax+HWp14WrVjCVduhWQZYDwQd72giHOzDXI75qxhfY/xy2DBNw6y1iNm+Mv37
+BOh+homW96mqCWL220JdkZCCSnXqeqI6EwV0ycd1ca1hPqGjQGMERJqn4QIDAQAB
+AoGAflcJdI7ox3h5mls6SHbNzCW7MpdwsgWy5P6q86yODPd5VzTvRYmBeYT4zbmF
+yNVeO99eEj86hBf39oBDD7GbAbrEmWJcuiPsEblj8zjlHKfEKHAh7TRbgnfWDvLc
+mpdnLNiJlO4CrkZhNMbWkmnZITtlRVsrwZeBPptNenAa0cECQQDpce4q8xnf3McT
+dT1qCWcl8R/OBesKrOobjwZDwaIAznkm5NYWwtbS5ZbtldXu0J1i3pSTyTvLtaQa
+y3pbSSUtAkEA2H+JlxumDWaEArZZDiqiOZeU0lZlo4Dayc6AiKstokRVFA+C/Vtz
+Zt3TzpvgGRmZVW/ksoWagL+SRfeBuPFmBQJAGulCXnsl2XO3E1wpl0a8OFiCpRpz
+jQh/+GtVeowg49zphH1O3NLbNva2nm7ueZhc/F/SWvMQzJwE7f3U/h8BhQJAYtiI
+F2fWPtQJfbuHmYI5oxXkKsyrhyUzv2P7J2sQYL/WIFycr9RrMhIhvHlKresUKP/3
+aNK7IgFVZYCFx8zfiQJAORQ9e4IY6macip/D7ESbIrpFMGAlv0kfa9vANV83omm2
+3ua9j3wBL+KgqY7GDwEGeJF7taY4X2Ad8Yt0J08PvA==
+-----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs7_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQC6VI2l6XB24wvluY8hH+8eJBv+1WeVuiNr9lVpkglaoisJcufl
+p/sEWc8nP4q4KDnZAiTrekRzbCl0j1qk/8ThQF53jySMTtjgMc/mg+RNXHcpriFY
+hJ9D0o7L1HV5lll4AN4PBSWwv4E1FSesWCgJeklJF0nx+Lm3oX9mK7MlewIDAQAB
+AoGAI6N+gEhZCXQ910+Zj7Vi7/nqHODGcj3q/oBcL9gNz/cKkkEXF7b8bQWceJ5P
+sw+GmPovA5ccNpNujmvI45xEFJmoS/+n8l5gm4xIelEklRhoW9NeFi671263X6TE
+03VyOLkCVqmhwl0GegZiAQg2ecVZjRDJnW5An2KBEBry1XECQQDmNR4hjO84g9gp
+RXIPYCPWUsXltM1TJ8LfsF/QyemGc08P3qGDwOunAa7PoGmp0/CzBaZMJKfstzip
+sYyIabWJAkEAzzTvo4zpXB4N/8ItL/BBW40iNflJWo6ZOFSu4C+nImNjocGIbF60
+VT0mOdiOI4uLiamUACEENB57jgZzIq+F4wJBAIByTOCdeXDIJ9lHVU/87aINRzxW
++GWYfuQ+zgd6UaFiP0/0gZw5DYN+reJNeAd5KQlKcrJzlXq/9I7CcU4/5TkCQEc0
+QLlqPfMK3PKrzo1vuXX1jPERRlTZNev2pdWiaoPVtbIraG8dKEk2Z0FvmoC6fmwD
+GznkHqauZvUKYFxmBtMCQB2x0m9E4U+f8e53cSziwnmsa8wIdKgDOGCdcMMeK2ur
+YmDorHkm9xXzHFiIFFbyTiwbf2hvhvztve4jafgKg0U=
+-----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/cs8_p1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXAIBAAKBgQCtck/QuCvEdMeRcXVeiYgv2L2vzUCge0iHpNxjlgV5TLrXgOy/
+fzeeb2JM1ukQ8EYbXCP3V6EfY3e1TgX9F35Kpm3tRjnH4EV7t285J2RXNUrYATfG
+jluvKNepbJQjS5Ph5avbeg2wKx3omfUuien2N6qoCfviCjJZC+wbTuWtQwIDAQAB
+AoGAA93Zg6inaSDFViu2Vx4vyAlH6URlHW7CJiv5scqlYpfgTm+UV4yJe+G1ykq8
+NWF13qRGNPxiHiYEhCkyHvtIGG6B5rcX74qM+NfOsZVJX0WyzApzsXZ5Ggx6oMfB
+dCuxUaiNbQG+W7jHT/Z5xQReFoYsf5Y7p7T3NuQMNNItNnECQQDlAEy0f/tXanAO
+GnEQttqWd7rYVTxPs5+mIVWCSbB3XQgRKrjImbdSqmLnqTvzcGbWUgdksCjjGF3X
+P6MOsre5AkEAweVD4KMVhGKZR6NjVtEiXlSmI9meXb9GFAc8MWPeY8+VVzSj+kgV
+u7Vzgq7cqTSKmnb7ohlx51WVAVEG0JOS2wJAHOv1xBIp1zd9IXrbbsX5Q2mpsmrJ
+bDN+ZUfueb7+x4R7YVeo8MThL1KPnTx1cuBuTIEdp+zLrSrFp0rFODUAGQJBAKEB
+U7/xLCjmBwnprs+kkblq6RrT1iFad0KiT2Vj3INdGFF1sMRfn0xjfCuEME+BBacG
+LiWIo4DJHBYfxlzkbgkCQEsJSS6fdiqiKzw2ympjwuTvj91rUCIHn9yzuvWAL65t
+AdYAhnmRFoO7PIV1JJS780PHj6postUCTvuNHuG9dno=
+-----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/i1_ta1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/i1_ta1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQDGps75AD9HPjxysKfYKewTiouV2cGTwq9Q+SFWNkBciwiZvVZd
-kVZGXOitRMqLtSkDWKTkGbMxnrc57l4rRaA2XAxj9+TO/yfivXI9/qU2uMaHBIp4
-lEBWP4vaMoKZbBlj6qPCIaK5mYbWsHA4Lk9bNwCsxY5znz3LrgxuuNQeMQIDAQAB
-AoGATd6xn1YDeA/jbinlgYzdZ8OVeAZGJX/ZbWpbMQpPLHerxWg85KzGHwrogpNG
-uoEnNJKZAHk6jybiOClCbL/8TuGl1xuBVdscrtOzT+fZW1IVsxEa84LQ+hM/j+OI
-derkbPGuzyftCX7xrEnLKt7uIgliz5nozfK1EKV3ujgSRmECQQDvUDzVnNwO27XX
-mgYBerSCroGxPnCyaiB82qhC/vBeRUZ5TX35hmmcp9WkNF4RsOso1RNxlJX2tmYa
-c559Z+VdAkEA1IDBDy8K/Vim8eacru2w1T5+eK90gKxodcQoMunyPkFAweqJXbNE
-fQdjyTcAnY45nI+tXtBabLBrRW2RjfKa5QJALzNGLGOZy5xuCy4nzRbkj3nXvpuw
-IqBn8/g0g7JAunczZS1xkUt/fRRlQNPLUfXxC8aq5RYHVfe3v7PaKKXbSQJASNr/
-1bnWNbfgPM1I6Lx7RRERAUV+VuNFSSMAeTw2Hlv23MURZXuhvo/7CTB/WIU7gU7N
-LNWYOu1dScdgAN+tdQJAbQsyLT15GILt7PMyIf4pxREpOKttra1ArB61bmTmsyJ/
-fnPYpu92oOSE6q6uzR3xDaYMCuV8eTLxQJ2DH9qRnw==
+MIICWwIBAAKBgQDLNMSD4SM6MFjqCH9rgX18FRxylEecrxnyLxzcfU+9DtENPD9c
+lAt15KbOyPlTQItJNbl2Om8oA/ihHn/nycC1qtwsoCOUxkc6VWRQeakI4qucfrmE
+tLLmELaijrFatGkbEtONfERE4aHHMbFKl2N+q6UCPPMqEKKRPmP5sFSFhwIDAQAB
+AoGANxIA5ADCzEVIA3z0E02PlW4fPIok8jieHn1YJAUt8/2s+BpIza0tgfDKqCXd
+NAu888VEkt75Ou4AlqGuZkHOILFZ5W+SYY6r0GrZBMtj729Mn+ENlIvONomtcXLu
+4hHZZ+NqtXfTCdy+xHcsIRcVF5N0M02nUVoDRNHiVDGSXkkCQQD/Pef0JvBhnEBS
+eXpmo+k4E/0V0WYz808rkrp6lITvCtgOScQ9GwjgkpmVFozYyKqBYAH7pYkp80RJ
+m5U2XWgVAkEAy89Kv2PmO9uMlpQSTYdaZf9BAV3/1vH5dPWfZlZjdeYvk4qYTgsD
+eiOOU+/Zh+q+Ih1aSNjVw/QVsTWs4JxiKwJACkwhE4SOpiF7ptgnzARI4G5OA5dT
+HD1wsD1XMKLVSh+R3+Gx/RUeIpFHiPBD9msCFf4dll1zTzH1S1LvjiXukQJADGO9
+l4TrKhheo4i81Bm2VRz/RqYAN4DeOU31MrNtuG0V11JFj/j7bSFcNZ4PC0Qp6sj+
+BA+qbw8Xgn5Q1BatoQJAI5L+o6A2C8+P8WlZGbJvAZ/Ao6LnFYB0UlUnQhQZKsot
+5TtxCfORFGJL45dOfe5mr+BkSaVWAeEsaHnFPcu9SA==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/i2_ta1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/i2_ta1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC5a+zdfwbirKVWifobiwfadtapYsCyz//B65Wx53RC7q8okj6G
-OiSJ8mDN8yndrRg//9fMiFo2/S0WRmdqCIYQLvzPPs29xjDyjMhj0nAXHsC0J1xo
-/4McTKYYL0NOREzeRFK/2tq0G+6F2NcKFAlC6fSHg/OFpoFkV7IS3qcDJwIDAQAB
-AoGAKYCjsuw00VXNaDJX/gQ/jMGeyKkm8p8l4vTlO73Pww+DuzQItKic9xd+XXq4
-+zo8PE76sXgvoTFH/z1g9lXUE7dWh/zgTf08velDswfgm8vZGctfDNYyOR7BaLhz
-CAqLCJ6FvVQipKXzInCuHDINIt/35uPCq0ZoofpyG1O+B1kCQQDuBmAqkolg0SXc
-8eQ52jAcwlQuYlz/axFE/9W8yKlBtCSihf5ebk3qA+Jjsk8PXE3fI5Yo8KhDkI0i
-ok5AQ7KzAkEAx2yYGdzzNEUGpOKNbNuTVgaVXeK10bk4280muALhyN1lHvCxDHQQ
-dighuXCqVODOxMk/wTdpVLOl4x/CAOoXvQJADXPey4ksqoQnl600MPDb90Qkbdqx
-Vt4+Q6AR/HF633PG/kiEb+HcFXXSvb++KCgXXp0sR3QSjn8E+wghVBB/cQJAEeqv
-v6MaNpf9ANNZ4W3YzuHIiabUrwL1GMpVsDKSFnnNm/oD7hp/YB466W4132pTKVrr
-X3CbBgEd5kn0JCDkAQJBAJv063BGCCCZWY5nCWwFaHvQ06G2mCMIpxGh+N+LHLGR
-c5B5TGhJsT1Rwnij+NQ93jAyaqc3IxJnHw1eCXk3F84=
+MIICWwIBAAKBgQCxK1BSDgElsBqLWMLjmUdUMkF5W14qN3rYSs+RJnJxN4wMT1hO
+UhvtM07DIgqt2PJ7oQwXeVfrKg/fTWXjc04bp7qyS8AsYxFz9BKWYNEGRNUpud/h
+uosvfd+Cn/Em4NDsLc35U+jqPj3jRd0vywK+tIi556koRzM5BDGWf5G3dwIDAQAB
+AoGAN8MNNbZIsCb8Q819EYuFwr9KkjqqqZjqpjbtm57BOFcmUh2LCqOXPJIAgTQu
+rkbxEu4+UwkTHeYQNtUyc2MwOse9fmJaLqoPMTIyfC641289okWshCnYTmMrAP5A
+7V+02VCVX3WmqB/qiV9j3ieyQsEGG0GoWoQE7+6z/LgR7ykCQQDizACn7ws0rO1p
+xtNfttukpUgSg3pYfn18+3WiHgYBY3wBj78fv6LAtoyXuv+7kdHJTYNKB6ee3BNR
+3Q9dkRxdAkEAx/tp3paGagEMguDP6LoUSPmD6QedTdBgGRMpHIfC85R+vOVtPLX/
+PUG44FUtbBVdUi59GaugsqxPwvyUMDrF4wJAA5QIZp3k5V3dGRAkAZyW9pANBQ3B
+/mdwf2pQPtCOc7MoH7Yu48dYQAYhTbuLkWAJmU15xs88G8uJGn+MYIOLmQJAcE7k
+TOoSAJQoN5QTjup5m+Xsy8DH+bxNS6e0Dd68gFjjuCfMaiz3c6pmLi4HvUxeRVnw
+TatSKyWUAbghbNiE6wJAOnyMv4Qkk3+DF+oAb1Igk073bHAIpgb0TYxJppiEMkWD
+p3cm6ZgZEhaNjjqQs+guUuQkVoO0iyJIfBRDap0RPA==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCqsDTR8hZv99UzjUVmLL4B7GjJMcruf5P81hcT4Lr7KeFwOxIV
-OrJClosl0fNZZFj6rY0mO89LiOEyby7jadNKTX7I+Vx6QKkUug4+p/HZf6c/3i2W
-g1LXH+v/6QhmNdg4ihW3Dl6l4k3jdLYeFAV4Z+37gsxVxQPfZI8J0DvF0wIDAQAB
-AoGAdq9jawCMfXq0ss3ujadaz3eVPSD0XHY1br9m+JlxKqfqa+GHJ1/TB94qDzg3
-n9bY0CXRWd6Iu5sIC8unrNWu5n7ZrWjfgHIwpLAyK1inXYc+JH/65KFsuwBHwwer
-oeXEkZQCA2NnwW8z8P3nkurGL6AgWZn1dqXl+DA5oc5u50ECQQDStkPvGXCNtI6V
-EHauC4lF4YKV/Z2EeUmyb6WKlXtNmA2IhK7gUIQsNHtSPXfRGy5asNW+t2vxFyJz
-4RrVJcrRAkEAz1/FH8LsejLgOciJ86j0m7mbRYRKlezopIkE7StT4i5OqgtpeJW3
-bgE6GpSwRS22BdLW0Ae99PncTvfrOlCnYwJASkK0NHr5wOdGbOCNgw9LxNYSSLxG
-HF8Gix1v8SR3fUQ+WMOyQhn+SvoAEF7bcFWtA4dY/Ur1ftVRbheCdmZIUQJAFaZP
-9CLrgU5yblXrYQ7Qirlz5mwLRV+4YgUUCJavaTugZsxONJKc1dU29bN0O6SsDiuW
-1Z0ZTcwQHgZv/mSRNQJBAMUp7XvzH71CBnTrQ5ZX7akV5bAIBFSGwMtDgYZT0DVA
-KSTa6BQ3waXBnSb8hct4//TVIqlj/CadjsTQjCS4h48=
+MIICXgIBAAKBgQDfmeExIVJMUiF0rspN6XVtOiN1jpxSoz5Tz/vNzEd00o5dZVeh
+rRvPWCOeU508GkZgmNlePOXQxMsMKFmWXibIHSnpAaVaO9+eGoX0nVMOGYEg2Lw9
+KonnjP51YUWl92p/rZSilUtYNSpv6VRLLL8HCjkDfsCWG56POfpJPtBPawIDAQAB
+AoGAZbamDadOvJEPzvhD5rUwSYOM5cj9q0m+7HlL3g3y4110jV+wQUdxwxwg98Cp
+YdHB+ecN2iRxlkou41Tni9NAaCWu/AKuL0NYOSyFFFT+La88uWcFwLx3fl5ROQsb
+Uj34eRSzhO1C7Dl7EtsbkGoiEkhHepV1GcHX5CWoWszpnIECQQD3tVYBMUhphQTb
+zX0YEMb0Y9NZqi9Gn/6hnkt1fKhXEGZy/p1MNSyDsJfkFruWejmROKJLwVQOqUqo
+S0taYuK7AkEA5xX2s4/6c5cvYFQXzr5Jo+ikDpYO1T6xMMNm/W/py9BebmDnXHXj
+LhB1oJzZFBD3kFfo3jo9xB/6+ynr4fwzEQJBAK++TxuffJGo126fFw6Y8J75qDyo
+eswvvXerGDxtyf2jXBxgOveTjlaMVudznXnAk9FNjhATRPD1+Ur3yKmDGPsCQQCC
+pYxAoJn8V/FVCLYdEMAZhyGZjYT9UuBirVbA2lDYBgodZXPodk3mcS/Pil3AVodg
+eBMT8OGSzHHdJipSLX/BAkEA9ZoFsf4lODYD4KZnV76FW9o1zczrtcIcSVYseiVP
+9kqpMKqgruWmW1e91EmwCNnr7ELkVAWgRwfX0+IUp3xGpg==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQC97+FeoTL/7ptkGqPw4mNkq31gXjJgNvVnVNDgE27viMH/DmTS
-9MwH/RgDkPtzt5HJnpeysAqun4jcKf0sGQlD72h8q96R3lHL4jX8lv4T6Tzqlzwq
-75KaMXfkoiRAAW6gWe9+cdm+Wj/tfrbVezhtTBb4/ez7b4xB+/3cDFQc2wIDAQAB
-AoGBALgWqklMVaDGg6dHRsPut8TXjWH8ijjEq58mDnhPfYL9+oCZU9E+4A2SGVdD
-iuMB9XQDmSXgB8pt53jz3WSDM30QG/M30Y/hhauUqvGU7QbxK49sr+iJ+d1gq4PO
-Z8w0SkFkGe+HkKHhFR3iiPZ3t8FXS4fZspqh5V6Z/4UjwR1BAkEA4Z4rYqSoNvSx
-juY19uY/LuWV+eoMnIqB0s50+ossEUr7h0+1PLmLC8mF7towOCohPL0DdeKTQp6U
-84j/1mr9OwJBANeDq1PjITLqDssdKZkEeVksP5RXBsSMEdSazeUwwWGYFZCM3oin
-JAuA19bU9rxMVMLbZTOnESfOUHCN6nwZ5OECQEATwPSqGRBKnKceINN3fxhdoiOx
-YlWPTOHHOxfxMNnUdu1uKOYPODtnx78Xfrxk0r3CXNo9OF+iVGF6VlbaWgMCQH9g
-rE+ti/66xjmYp/Bv64UgGQgFE9Pxccx2HsGauoGDUSOZjyG3oB9IbMnmH1sVxndR
-ExSfZw1e7L5JstDcwSECQHMaTx3u9gaH4o2VQaujeQscxqaVV1NEg4VwnnYvKEPI
-JAfF6Z6kR9ncW5NUlvG4I/RN9EbOE3ndDB1nSGdODkI=
+MIICXQIBAAKBgQDd4PfK+UJq6Si/jAhITBf8NcUsDLQHfMHEBbuIFS8lI9tBsCSO
+VDtEAkuPYDsT7/l9jV3cNLMTuShdPEvBdmyu/6N6RHF2+QsazN9aN5yzEus4mTuF
+9+sTkzQCS1R8Uv2tWEZwr3stf1Za85VmWlIq2sOymHsvzUQvLSTJaimQ/QIDAQAB
+AoGAIGEgSEKv6qI0DCAHZWWVanz+VTtVWnJeZJjhkS5mPulIqgFmlE6+h2I+XKIS
+fQpcQnJK7EPUjmBK/7A47fa2TV31ViHmiAW4fly6TFGzoTCQfnoJ6qpcCjFVD9WU
+cA2NMC91AhmNKcZ3OF1Lt/gEwBTJ0EetIuXAaUSrHRVGLAECQQDzgTsHyE0JVOnI
+njg6gxlx3mjBKSXQFUAGYrKAIWMyZpUEWj2G9xFP4nEYq8p9uA+SzAPFnqZyAM80
+FgJWrPDBAkEA6UOmXTEWw7FfBfMou+WYO2W0Qnys6oUVCgARuwZoMotgy7MyqVa7
+MQg79m1E0oSwtQTuRnUKMHRUzxOn6K3zPQJBAMBQ4H5VBALKvZlk3KPZxs7YCYQF
+K4gcQGTKro/jzqSPwEGfw9hEabfd79S8WUDRjfsyhggeNPb1DLDmcRJjpAECQQDC
+BQnoc786kFq4STN1bhf8N7ECqE7vVjhUtBALXt3mRLYDWI7n+QMEWpP9eY+IBuQv
+/OTv58PM38X246OCzsUFAkB/74FxGAQ12eGQPjnlDEJj/aH29/46XvibGYzXhXb+
++etCtSYD15KpKsvbTma0/xHeQcNmPURdw70K4j4Xu5bl
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta4_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta4_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC09LGfSZeSGKn6lDf5RV8xxC32Gf6arE272n2ZDOHwsg+buMW6
-WPg+Un2DF8J6+a72JnWfF5qKC6AsONT8rAJ/Gy7Jktp5IRBbfFY83n5kUnNCXBtE
-lIsW3qvrs22KQRHHfgaT+qabAB3s1M0HaUZLfmB/S5P2jcUH/gtEqDzbpQIDAQAB
-AoGAN5qBAfsxEfl2McNdt8DzUW2A2gB+1bRgZnrq4R6uRrHQTf9m8q3oCe57Fs80
-OWmDs6t5tRshp42O+Ee2WrXYRgYjkGpD9p0/95+xdMeu4zQgEEAw+MhD4q0PjniP
-sH92Qy0fN16DO26GZMHmGGCZ5W/ckfHPUObX0btoYFmW+vkCQQDYoqIxj1EGxFrl
-Fq1AwE2saeF3NAqidPwODw04UuUQgmpqOVRp1Yw8jwj8lcBSZz7MDlmad+5bLwDv
-GGOknWnLAkEA1dZV70JzRIuNeQE2xKv5k07b66AM9DAnKMG9mvwFR6lJ3TxSbyWY
-Vt7O/iN368xwNh8sZirR8IYavzDD9EziTwJBAMcQIpQByoW6Vn+d59PRIU6l+I0t
-n/wKHTbZ897mpSAXhqtXRM7/cJ6RHMPk41WVE6o0IXgEbl0Rgv0xXxZ7oyMCQHJ+
-SpDK0ZD3743EmqB/PCglZxcoIQd16OGnqm+bVPBjsgrky3Z7eK+6qLXmI8V7NvGj
-i1BAyRuxkgygfasGp30CQQC0MhnOI5fBf+lCGoxvlSnV7+cojciT3Rd+RH+qjVQ1
-ljhJ2PKo9kxFo2KfRqcJnLpZCVjzm0CZ1twsc3EjqvKC
+MIICXAIBAAKBgQCuHujGUXDMewaHR6HwWvrzz8T966wy2avdNhUJcXMSo24WSq+D
+M9ngHOhjrMeNeUdaz2Nn4Q10vAkWi+EnJHhqQaXJL01J76JhgUWYIbMq04mUBhiH
+gZBj/EAXjYk1bsVo1W2J0xjiB+Gf9194JIMRxuULd8M/yVAmOZyLDRj+OwIDAQAB
+AoGAYzIIurK66ENOPNN6Vkv+m9fKCj6xI2cOmj+tTGvterjQhrKVutFXVm4hlmdg
+aCCnnfx4TT3RRKe7JbUa2AnW7wFMZwcpKY2eZTKj8eqH56zNcjzy7vmyADcRRrQb
+4/hJmH7XUTfrT34JUNWfn/SHV17giQzOfkk5SAmOhCP1CAECQQDXQqelA1obfDjn
+81yjavDRxruTiJrnS6scylgvvRKG+/93VYtiUbWFdOLlB8efTM0djUM4QF7Cutg4
+ZDahaieBAkEAzxMLBqPIEYe5IUtmPAHHqRVL5anl0uzVjcX1ThdzBG/UtlqV1zZ5
+n7X5sRWpsKkap/ji+taQVqwBWvhG6OejuwJAIU1bmEjTeOsX9rKMw295AEtJm8KH
+jH8FYvfe+su6gQ2dcT3XyYcwmQwDSkGQ3ZFJLmg7XQmAX4n+h4LhfMlqgQJAcJqU
+Zlnt08qQW5Ca2YrGPiX8jbkj5t0vC9dYG80YmJMPgtIjpVJUNQtJ6ogzLIPooOrw
+0yKWfusuGX/lX4WHPQJBALN29dCtKwoE64ikroR8pB+4ixNcTz2PMeb7rrGd4qGF
+vyBI0Z0IgDBGvZvnFfj+g1MroP88Nooz/v8kmBc6Uu0=
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta5_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA1_ta5_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDx60GfC/WMZh+MXeCaptM8pq9mNuJci8Sn//tv8GUzsqLyihyU
-rd6W13p1eOFfqMlRCP843y7PN7Ko5IJgVdVAvKCzlKRZUa3YJmTO1VQQWnhS8fi8
-1tynQFeCTy8JFt5biEKqZz4fi7duqR5qEqg1nyiFIyk6IA7NiT5zQOjWGwIDAQAB
-AoGAVLVv0OU7IeJQgbINh5mKtd4X5M6rDITUY48618NxbFzMueiqgVUwb9kbxC6D
-nB9Z/soLtDpSBbUXFhSNonXrqYUantKTYaISJKMAnV0RnmqdGM7JfKH6ocLQPz2+
-eXgq/orO+LtM63Ot5IQSbI5zmGikA8tmsAWyQvjFwvEv4AECQQD6NXZW8kLAWVw7
-rL8phCU4XwoOsu9cBGzNySogGiMd4+F6e6gP2mYIlg32Z9vZW8yXYR7BFirNaBNT
-y1EDyawBAkEA94SsyMKBx5f3xsioILwcnfoCvggkAlO/I5ihHqQwuwl7/0IVXrBx
-4uAjJD6xMry89oFWaisHVMSHIGyfPQuyGwJBANgzHAdzHFTColz6HtBL3DGChdk/
-qm5TcIS8v0av7woj37CLayQPrjzbFEOHaMO/e+COThnAAsoslQ7Bz0Y7nAECQQCn
-ufZEDNpY4Hf88lhL5m0V+CcHkwijsxBhFLqJwwVqmSC3dpZ4leR2sx/dHcaB9Tev
-azGdvA65uHtA05qMiXJlAkAgwV3LXDraq/KgUOQVFrr37gwJXxIINpuCe9ljt9+I
-Wey574+RFcaVIYlKI+7Ql6h6eGlxHCPSaSis9sdEvvMK
+MIICXQIBAAKBgQDUxmkRRS8ysCCNLQ9cXjYQ72M3agO0YoZoj/tyh5EVX461JQzR
+s8BXKLVW2Iu8wPXtitD7VkWRyq6jL/E2v1SRxpMEaBcn5Zb9kq+PW2Jl9y1tWtwv
+BUS3fd5JJgvsCXHQvTmXWwrIgFtrqhmMst9z6s6jSLGyuj9YP3WGsJxMWwIDAQAB
+AoGAHMMRUtdSUPzD+bF8oRTPJCzn8YawJ4Ml/h5wdAPlVclMBiqS+AnfVyjWkn3F
+Lee7lresFj2MO+/0+XQynB7y9F5lpq2EeeCuO6sdTIJVkaR4gqqEczQ+XExwNp5v
+p4fewlozlz/iARM8TWplRXHOlaAU3JKNn3b1QEYBb25T+vkCQQD8BVKh9bhHmlXV
+G2pFp7KLfPuz4jQWfVG0kDxMHVwwxLZthEvI/duKtqHEe9GPJCDgnkvNFYad/hh7
+Fvhsab6dAkEA2CJ0cwSV0I3ER+kOPOH5CGTnHlGEjMW0tdegwdLhHnRXod1OA1lU
+uOt7MJWdk1Tt4Wae4DIIUaLbZlitTw0JVwJBALyBTrmODfSg4Cqygt7u/IGRTsPS
+IpvfyMmCSVe1bkucF8f6+KSyHRC4Ym+RHcIvh9f7Dz+rJjHu6WjIWbDdt5ECQAFw
+8V/W9vzGBToJhsvHIfb5XUUpe/3IT7Uqs+q28kNWuULeC+gfz13QTCj9xmg2F8P6
+ADM0gjOxJ09eZgFx788CQQDWxnT0Qfdixcm1o2HrbbJ5bUTp+WQAF2qqShIZKHTR
+ji28neWEQIpK3U6jTinfsyTYh8yWXhhWRGZkE70dVMPO
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/pubCA2_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA2_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCRJ7eTnV3lnuldeOId/3MO16dOo7/j/zMIyankb7yluTMyKY/a
-0WNRDDvahDK7dChw0wc7PawvfcKeSk58NDfmHXaqRKBWyYODE35nkZmvXVo2XaYg
-I0r1qAgSXklSS67T5rRj+C4dgF+9H1h1NJLOvmo7+CX9ZEm2/msD3AyeTwIDAQAB
-AoGAT1BmbNBWGDvmw95jn4SPeBK6JqwvFAPD/Q9EN8AeUmeJ4+T159j17blDkzkd
-B3SHDG8iymn+hcyv5RIxJIjb6ZyRdHL8lSJG66KrU9kdoDZxn+OhlocHJ5BJZ/o0
-8nmrZLuutY4JN97pzk+jIKD4aBffC6LFiJDpDSIhmfabd+ECQQDBeUb7NklAKPms
-mlCgcwF9FjR2fGh0vIViuc/3bCQpU+WPNlDqBIP0b6TNxQ3nmBCpPF9SO1mcBVYK
-5XJIJHjpAkEAwBDh8mB8oz8STh7ZccqFacDaN8qUYGECtion5YyUTRA1XW4Urg/v
-pXYn1etNw6viGLsrX1lhS350oXZMTdLadwJAZDOBdZ259kbCeIg7db3aaYRUi4EH
-QF5a3rTJZqVVXSocXD2PToQkKzafLgr+lpGFH4ErBRXD5TBGTcJjm8V38QJBAKBO
-dwgCGIV4oyKpBPzA+FGoMXrXjrhSwByjWuFxUGZx3Ni6hHAzxOXplJ4r46Ap2nCh
-6DWROG/2gAoz3sQl9UkCQChPoIdCI+wx9EfHnELXMzzEIuqAS1DmJ+CXKTsmzpLg
-UoKNATRkMIM6elwJ2VQvXdMkcO4iApiBD3mL4GgAoEM=
+MIICXAIBAAKBgQC4wO0/7rLEgoWCbtzSY3LZ13O/JLxaq5qqOdwBI5VAixzECOE6
+IKnzIeTK6ci+SFI0NV+vGWCJek+V4sLcCvJ6fWLO1TlVThDY2pBIc2lk732pV6Ly
+bebb0KPfKqHB9MZEMryv2btewTkQJ/0ebp/cZWMcnL07sY+a2oJuW3GglwIDAQAB
+AoGAJoRaMezyqhNIAERalyYSiKXpRJ1FA2YpTXnYiwg/EoCuE5SCWBr9M2oKh98r
+cbgkIyxJcXjJ7n9oXigzVaqWmGW/RdPLj0w3Djzwkdio9oSlb8PoDyiE3JC5uPDS
+jadVWBKfZOrodnJf2VAKAEyGaRgcSti/J1Z3M8jfHP66eWkCQQDupJ+uXS0IOfXw
+nYn4PGLZL2g2F8pip/AkPo44pRzxaxohYpKKF45Iuw3bZW6VU9i6ByRg0H5NW0Dm
+9ef7SQ9tAkEAxjDqzIXfd1EFzT9E1oVeBFG7U1lfKBTMgNPU6qbNfJBoEXlzcC2w
++i6u+qHV/KiZhBk676XDc1Vqwb+kJri5kwJAX8R4wERsGe0IoXLXN2MkV/wKWgra
+ERVL7X+dG2ZHYyqT5enk3L3vP4ixWuYtpodrZdwP4TpKNUj1lroASntbUQJAS1lF
+q0QqVV6Eaifnr/c8az/3jBSqTL67kS73/84yyWzNY/dcoAV/B17AP6FPjaM72jEN
+axcGW87Zq5eEfQQ16QJBALJTo1rrNcW+nsR2wBPml8k+1m33IIy5WlFnCk91gPm1
+qkZp+waTo0d1ekEYONIQDleiQPWmSzLTmC+YyfXL4Nc=
 -----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA2_ta4_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQC0rUNWwEdZRRebJZSmPwf6DYwXvR3qsBRzT6uRreVyFajDXdI3
+0xyfDbWxXdzpyt26WN7XEMrO93ZK2mKHBAA07tIqMvpXDqOoDPiYZXKbZS2QUL7A
+oi4zE1UvF4+Igyrp4KHhbUPRL6drTKlnjz2dPEaRyPy4OGUWxWC4in424wIDAQAB
+AoGAUIzWcryykogNKCwvA5ciVUbo6ER2LAVoeKhSU1Z17tDdNoyDhkPmhLq2AGda
+cBjzlXq9jqB76p3E7UZDmvIbrL3Ckkpuv126liiVkQkwTr/CK8ax0ejHEUYoJsUX
+cVkR/G43c8jD2hnGJTGMu59xc1VHAdEWD3/TNPHkddZtMTECQQDgkUAG1ha/8Tp5
+iAP3mQUn9nDlxcs9T0ZZd7N/8Mgz1LtFhdPlRZNkoGfWinA848ZGPQXgTnkzhoFY
+wRfDPRgFAkEAzfdQ2dwk3Iy38+Qmdn6og/eIwt+mQL8Vi4DPiUQ9H/oDWzPeAXgF
+kEliRBMcJ4ghPJDwymI5bhdwxe2gk+tPxwJACk6gYa/x2113EZzskbC0S+FDzUgG
+zAmXcQPNeVHT3o0lC0vZLezDlxrFqVMxU5ogv5iNbH4tke/af/hc3tkvAQJBAI6H
+nwOkPD4DgyjbsWI+tA7etV1lt38GvLoVIYk0F7iRItFySydpDzCSF9ZUAx+4LIfl
+JTxoTKXKwte1YXH7XPECQQC8m4hYpuH6PI5Fm/3GozP0IS0iJfNlD/AAUtF3FDmf
+iWtKoRphc0qLJND8eYAxL3nGPDWAwppt3sJEwk7QuNbv
+-----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/pubCA3_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA3_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCVo4W1cfMvsqrCM/9McEDhBkTofA94dyEdpornDOdlEvXMmc9K
-AL1e6k3Ho4WTDExKF0RJ2bkGRbSZ0JUIqvbEB3VGpyY65QFkJnTHWHPpcE+XFU4w
-vVWOy0MzNor5zFfm7iobqg5nUcVSYatDW/LXLCBcwXKkOruwoju0buO53wIDAQAB
-AoGBAIDK4K995zi7h7tk86x/xWeodLDA7rPZnRgfGtiow5S8D/FMxRxFrLg/5Dgb
-J0GcSSFQC0eg7F5Yqovk+hEezQo1EVX6I/goqoatJhquys0pObPzC5hLnJSmSpm0
-HA9y6afbE33nLGaOQYx4JTSMLdVrQsGQbLTy3lzxJSkDM54RAkEAxHMNHL3Nwsc0
-rjGAiqsw+fQWejlKTGLJRAyw8fwIris9JoUnzqjGYhCP6NLQzcteksbqvHcktBpC
-Fa5qo5CBaQJBAML/2dhsi7zy5N0gTK+msQc6zn7mZKeGD6HpVSgwi1NCmmQmqCcb
-HiKq9TaXGY3+XRrNnLiKSPP6e0NxEB44sAcCQG2VeEUGI9d5ZAuflYLFCCcGX9uC
-Rc3idT8+jR4PZ5AwkoYAVTpUr4VYk85eexexUGo0CBFlrNXCqAaMKvRe0bECQCUV
-IKleowhQrKM8lDjHG11DmqdZSwTsoqZoyA/3g1dXECNBkrK1Hnr7RdyWyX5ORAhn
-14jki1ESbkR6CNWmdBsCQQCrRaq+vNQgAl/JVf4GT97pW2G/3DJxKqfrSQWNiQit
-hDZ9S5xhIFNsDsB3AxAoPKk5qk71wMc9WC0G4kd/E9Iy
+MIICXQIBAAKBgQC6sZD0+k6CVgSSetXXI5PkU0fCKAbDoW7tfAIO9nMLjhF1M/PR
+mMCtNxK4QRpXEpVeY2G1aZdgB2xuS6UZDvi6NZ168Fx0M3p4JM0vKs0xhBcP4E0G
+upJ6rtCpVIDx0k3c6YGErcl0wIjoZ2NwKsSFdbgyqO2vKmtjU5cn053mVwIDAQAB
+AoGALODGYb1R5g7bZoLUqLTKtlY2p7uLdLd3vOrUa9hea2apV603bSj1GC5m95fe
+xxOWiGwHbt6FHvZp4FGazF1G+MJNGCnhAH5snJaaBaAyF8AkhwijXbZohKPL/DiZ
+DkjpWtgV7RemTVKTgyN1JmT/fpkR69cBFMYwILBvN0voMyECQQD21paPfe1Dne4i
+jdSCsdKRbk4u5qPnOwdUsh0aPEHJiG5PNBFE4iDPMoHq6dinlBtbZ4bLOWAsUvwZ
+Rs4CKszvAkEAwZ9+tB1PeCWt7we+VGRuWVI5LORqAvt98RpKPmhTUC3K4OEcOFOR
+jD/67dREs2uirPH8KF+mhq1FIGFzNvRNGQJAQa2rdhbNsPYuzObsKrJiEuxExVn9
+NqOQOcsCz15FKviwUUbLaYa5sCgCRZ1fVoekF9geF6j2nBSgm6EpY4475QJBAJlK
+2xdidT5cJn6uFMPf13WkIVwnYr8FuUofVFRgaEV8W7j6wErf7sWpCdMtUU7zkpF1
+6/tS7xaFK8tdG8iQVlECQQCC39PMnIkEi0VQomJ1KGWWKLUPVj/v1volfaz/U3rL
+NVZGWTYTKO432ARwG+juMsD4z6uVHnEjtuYB3mKnVCZf
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/pubCA4_ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA4_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQCyinoiF6O+/zVz8RM04sEC4x6m2LzCKaad4ZYLKzhC2/Sf+AXA
-2YGrNzXaJBvllWvF2ujBFMPHPqQgziV1XxPUlE18aUKC7wnJsRHdoNnidkf9aOfs
-EQL3ppLaULid6JCd9+LWzTV+HPYxcTn+Gl1JzFDHNP3L4YU65KYVmn9rxQIDAQAB
-AoGAdaD6en+sqGeoJe0MxGko1OgiB7cAFcQvPBGmM1GUTahw8PwNflNPNSi42DG2
-F3psePyTILK3kgvZQqvOzheIDgprhtqwDcaKe/voNJ/toa0dOwebP02VuaM7TFnc
-P01f24icN3hvtc8aJ8qehXYKBeq5WhugA2+lSjXv0MUP0TkCQQDf+iepx5BTP5t8
-eDdqbGyFF4EE/ZXYRZgK/k7OXYLqqTqTXwxrsXhgxeJ1j7lmg1NQfkKPhYhdDBGF
-Y9oNP8TDAkEAzBFMe1PcgH3J8dbSK0SNp0wpTxdeIDw40J1z5K2O7bwT7h2BABul
-1eWWL2MrAM/rYVkWoopIDJj6KJf8FUdk1wJAMlq9PBBfxDeSr2Mfok+J/koQeZzB
-aYQL8LzH3uFrI3K0dplx42xc0fTrOt77Ia74tioMsNOmmrSx47lVNpFVnQJBAIsS
-3wTNymDnWVGwDdvfBIsXpK96RXPClxXVuL4IangqzYpiISBpt0NnDEuPUidjjA70
-IDD1/NRZDWPM8MevuFECQQC+acVEnV2XNb7K4eeXeG/A9ay6nKemNF1iSFeuiPHq
-XWOs1du2hPSSsLxWGJiAXn0UgZou3Uo8ZVcUoUkRxnHU
+MIICXQIBAAKBgQDKqsQLdSe4ogOA/Vud2x3RaRtOu33GiNu2FF328v9F87Z0fzW2
+oZdJXoq8lDYl0TU0NFUK4H/jwRv+J+4zUwI7oaeZ7fHRuBqRFrqDnAINeAwceVl0
+vPELIRr6qlVypbQ5mUAcd9oX1m+iFGGWX8UU2Gzsgvm0RXZosqkH7pTfZQIDAQAB
+AoGBALrgkdt60QC4LADyHlvF443onGySCF1cbzRLPYXr9aV8H/72GgJoqIbX7ZgM
+Fo3yhlu38b8Q2fyaYYSPL18WKNRNkSyRLag4fV5ArK+5iKHKt32SlLsEn09Yfrkj
+R7qa2ZjMQKm46wrVaLSpbUgVBFZv35XYBMDtbayYGJXbmCcVAkEA52+KsZMgYpyO
+DjVbLtk3r6tfbCNsvS36dTgqcyroNOeAop8IigkJhVO3xQ+/bwYu5JzuKJaUPWmF
+7OUtnv7ykwJBAOAtiUAqI/haEp0trHgNuMesaL3hy55V6ys6GkCO+D/409SK4Uyb
+jrtwxndrjj7OF3oy0VPqe0iPueO7PrRmSScCQFFUwoHK+WuOJuHZYFTjYw1qBRuk
+i1ckLEs7VLeqUXYeEPeVOdQAfwcKt58Z/KVQn/QZLhy3Zhr61WS92T1xzN8CQQCF
+ibqLdU7N/uG9rVpifVIH52TRT3Kak/WtX0QKFuA8Qz30CvKgTr2cXFZtBq3KLbwA
+d8sH4NKla7BAvuZgUdnbAkB2H9ZVhrSWTa/2xvmkVp26b5TYMuAGQau9oFDb83XU
+rwA8G4unt4XKJvoqV071qzmESyqkCrbdNI2hZXHkeTiz
 -----END RSA PRIVATE KEY-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/keys/pubCA5_ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQDBfegBh8ApVU/ngkk/01gjr2BYImjZ/me0aZ5I7rkF3DGFnV66
+LxlhlyDVmdmEZ1DOvxvvhgdwDv0/IqkWENYt9jAjNlQoFjPVWGwV+3kurwdDdxG7
+VOnj5VxbWmdvu0MITsOodwYlkhDMyx1KfQcegx5DWby1Vhj2LopOUr/+wQIDAQAB
+AoGBAK689rXTE44AVm3bci0qvtFTQy20vX4IyzzZmTGCLSOGrE5fRTnc6Q4B/owI
+KbDx4L8lRaQ1JShk0P2gXpTn1ZMO933XqmMH0tXh2DK3S9SORXABVUS+0Z3E3NDs
+dGWK9PUzbBsX0HIJxgeEbPHadoY6YS7G675X3C5nzWaJ8i9FAkEA8gg3gibOShzP
+HB6mGyafbETVMGibSkwnNsLjLSttbrUV+GJubedAcPmVbhm2oKLkCYR43e1JpweU
+eZzfyDZXLwJBAMyojiK5qhWzVVX9pdwUyxJ/GZ6wvwfTH4depiMvYPaycZ/OinMq
+KLi+c/ttGW2ZO8OvTPNqHSPogD+lAEw0jQ8CQQCc9mM5Tv1d5w0SCXZkCUo+pu0z
+dcOwDW8o/n7iHlXcBCh5ayx+rgiGu/YC7z4XM0x8N6NDGc44Opw5ulkOuN8VAkBf
+be0w9gAANGoDOc4ADFYQnuF0ZJf+7wwRlCnF2E7PWa+vw6A9SRhJ5MyyHVIxD7WV
+boVkL0O9Pamng6na3tozAkEA08Pv16+h9lLdOA83mAcjIqMV5MDMlnMAJB4zWdK6
+1z9/Ga3gpgB4whNg6zn/aj/X4rzxesCUq8RtzKCcvmO55w==
+-----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ta1_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ta1_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQCnZGdT8prJzqlKkhZXYcOvnQ6fYYKtz3+qWfL6Bj2irU/bkD5I
-PgDU65bCGbPgavIhYYOS3YZQ/8Y/3iKcHHTLCQbneMKM+JguteTC9L+3kkavx9Zs
-WQfZjAaWG+8Q3D74iwidvYE8DaPpVV8bBDm5f/TP1vmiMTqDliGSpxPETQIDAQAB
-AoGAGY3tbFZsJQTkuVqmCH8HVcb/VXuYbJpx3frPajYLsMsOlvFlYLf+foLcyBMO
-b+NDxa7SXFhvSexSQqvR0s1RUvJ9vBrP/14EC9ObTvlafakt2KfizQSuF/LYh2Q8
-T34YnF7TX7F23d8bi2OmRdBRD4+v81LtkpH/qNgTNda4tiECQQDSry1gxKWtkr7J
-qcncDuhWBs6rppVEQ9EqXUsQjv9a/U7O7Ta0sxMuz8zHpbj+xro6UnH5Uzav7jIa
-WDEmMb3pAkEAy2VztwOAowfYr4i3utMsOkq7h4N2K4kW3YrWmmPJFSxp6LzYL2bu
-qQINrrb3QaIu3uN10YzLXZ+o6/wzA2OgxQJAfKbGi2VtvPeAyCIb24Y6coOOjcJ+
-uCgDvjP6cK6aaMRMd2OkJV96Lw0lVM45WQxNLKqQ4noYdhjRLgMV+Uoe2QJAWJi5
-fdetudYaIeP4vA1uL3oME6xE1hPh/OCUOC4NEgcFnxZbSNKaVM4LLbaPH2zI49fK
-o1uj3gVE7H4vrmNATQJAF5DiwcQmoF0EPY1WgAcd1tgcOwnJrC4zbfEnxOtEG2uZ
-GHVI1XLbEJTdwQUdSCBG9XT40+2hrG0Y17zoFyLpyg==
+MIICXQIBAAKBgQCk5VBP3YX/cP3pgsC0RE4/UF4yV1KeHc6WpDY4XyzAQSenTfQE
+2AVxs1akCTImOPgXptfoTPZkVuD7+mtBRJwG/vGZNdW7ZowS9qvNkALflJdejJSJ
+io8ui4o8CoUvmiU0rbSC5ARNqIvctEJYPcEPhSjXJSICuAnyIy5X693jMQIDAQAB
+AoGAa3yPPYBJOJmO6ggxVVCxMNRSkr4ZPLhxUgD41wYzRZ8zGfvWdNHbuqIMeCEG
+b6PzFHfNhb+lXQLE5Xv3LjRq/5hTRT2X3FRhZvWjBmvzb67LeMg8qsSidyas6U0j
+ZbCUTbnf47qw0ZlbzI1ulXoEnbwNJGmKzcMuwtJUt5/6t4ECQQDWmgTUL6FX1DaA
+pqgkrDAzTkXxbgGhK1fzs01po975AmW+/F8z56ahlS8OQI0f7Pkk8eGSQBsGR1Ac
+r65EN8THAkEAxLSZEwtjPJAAweW4mfkh2PkWL9P1yFPyiQy4lnLwoSwF4ftFFjJw
+gZwhzMWQMc6TZkkseRhqxkyqEqBaVXcwRwJAJjkurQCC01r4Djgg8M8+kpTZfmQi
+pCtNMhn4qt1GRMH5j2fyKROUqWkiBX7X5BzYT41JqTwD1D11dnaQKpRoVwJBAKAK
++IjAOSurVpJsH/hW9S0d7OlZIZ6ufqT3TrBKMHJR6S9mS122CEfMCswa6ik8FD2i
+x6Z3MVjKQ44IHbdv1D0CQQCGHUu0i4p+Z/cUauAvbZm6ft9Snj9vaSHJ4V5EvIa8
+MRPR3y+JaBcy4quuK2bFPyy2KtHGxXSVsblWWuRYbTum
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ta2_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ta2_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQC+PpzYhIJeS5+cDmSMn9CE2OTvXg7Cg5Tg729akT7FuRvPpYzY
-OX8R01Eft3x5Dg/0Dh00SXDMAQk0/8t5d4Q52b9nLOIViKea7K5HZxpy+x2+YCY6
-Io61Jj0Ew8Yjh008NFhdmvahoGHapsAGPsNr2/TLeu/3RO+xN+OGMXD8mwIDAQAB
-AoGAWXFelH1YPbUYSWqK44KPqqW+nLt//PuYF1j65X28IYGyDaIr4czGbT8IuPyv
-TMrLvVaVbGvK2F70UTKiG22RgEFjyjgm5fKhQQgZ+/hTVqrCefk8+ZdBOfhM4V4q
-FAQ2TOSw8uMz6JfPVJuaCBu5T64+3DlamRgZu/2rJh2jMSECQQDry16/peKyWybL
-hvre2kJW48gSniTwgjD/lsisna5H7F7iGPBfG/awLdexmKRL4akW56FXp7QsNf4W
-CemBUV5fAkEAzowDrLxUqAs37ovuKYpGyoCT7uPzZRKWe7zJYBPeP1NtzAjLN75B
-KE1uk9tHlGtrkWKOEfGq7geZWQZ6v+6TRQJBAL9xfVoo+2hILbVtwF4T42zcv+Kt
-19wWOGYsLH5J/+iRd3AnQ3JVJ/NfJRMilbKuYzUfl5WtqdGDfOqz3YyLXg0CQEcE
-sYbFQr59DQBCsOMrnmemijcLvfa0y3VEVmFos3RGtWwAYg+KpVC8PxcrwJLx1Iyq
-vHrDA6jQiBOqPK6d05kCQQDG8QyXPuvPrAdYlQf++7VZ0nYAEovLj4MZMQoWAsbz
-NdaQsiwzO6tSJHqIcQIHu0CGJId+TCP268Lh7mgrOtoc
+MIICXQIBAAKBgQDWOoQYetY67n1MdQoY9M7ALLVZ672DDDxZkAw1uchVpMEEiEHE
+QKhzTvHk24SquwN74V5dkaDuIj3zhDUJ3qkHaTXmj2XEVXBSpl82/2rTfMVs08tP
+odiUaBRJMpNMrawJJcW05ZLEXfXQSVTc5t+Ab8KGNDkO5qibazIhQcp7rQIDAQAB
+AoGBALblnoGH3f7SPgdYpRZJa3qGsQ3kRhfsClossT/tLSxxTJkh+4Qh768CZ2KM
+R+e7Ym4RKw+XlV25vkp5RQ74GjW5oGvDzkOH8NsFBx9yQwG+E1vR5JhX3cHM3ews
+IrfXzBW39FGpX0oWl9AW485ZsPmaVk1FD0oRgsyya+yEjRgBAkEA7e70eSuinGjG
+rj/aRJwqzf77OQW5hGb2u+Q5yxUT6s4izs3g4eKpdllUm2y9rFinq18Odae19UL7
+0ChtCaWDDQJBAOZ+xuBNRyz3kwsSrVv+qdlbhK/tJM8V/dDwLvuqkO0D56ORhBWe
+clvHpNOpuhHmlai3npCJhLdb9/DeXwF9MyECQEqMkkDc8Sg8k/PIweS5YZgFikVF
+i+j2MdyRF6KPyhvJ1pIhY5Ki6CHSv3WrToqPhIlnUSqAD7z27ds8r11UZIkCQCSV
+hrdfTKbEfOBLDJ0HZKoNLphFyYvc77ZUCQEE54/XCNMba52K0pfirjSyQchJkwN+
+cXp7eUcpH8dpZCb2WkECQQCviGvKbAO5OwnWTI51HioYmqMmKIf1gPyRiPW6PkXw
+nGCsBSr4/AxpS9d4cG+XDEvgG/9bI01VWtIFSXk0pMd4
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ta3_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ta3_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQDMMufSDb6CH0jL13RTyXqEmSrS0AGs4iajjAKs2FETMR3GTJN0
-hJ3nMoeqiNvtQWnuXc1xvzvDRVjCxzg+5o6jftfQV/tTqcOdUWtJQ3PqaRifOvJC
-nDx7EyH1uLScWPzqp70/U0WJZI1WEztOJtH5yjqNXnPOfw2xjcLhlgQzsQIDAQAB
-AoGBAIaK3/2h+q0nycItYsM2FFi7xuCCFyh/FbBatwSFvt2jVhfrKpjyLExCGet+
-I1Iu8IoTGiNhOhJOZc5ojyG6ra3UdAbB9H4wuW3xcOxt4rdjDzkWGYFF0XgkvHqJ
-nEEtOoLFn+p1CUlt8Bz9Hu7t/X4zBxR5GOArKB2yRB6cSVwxAkEA7xz7ziSrTeTa
-vd0mrxwhwlEqn3s35xdPaOOf97DCUJt+ywlWKqYuBWjkjb8b1x1JRU5lC+D5PAnz
-JIHFCl48BQJBANqesTFP6b/SUWtTMcH0yBbv+2oPHMgixQ2AUWPZcLKXMXEJWjFA
-AWwwFmeHWo4AFmXijOGb9h+aEAhuPX/zlL0CQQCGk2RxOBglxfkKxO4hvg6OBAqe
-KcZjzK3H1dzRle03Wty4vy9833ylVMzVrkqn/nafiCi8z8jWbq8my9avKCxVAkBx
-9jViAklUYBtnOgf/Fk3Tfyfs4pHbVhyobBKBXVDdF+mDBiAI+leDgRG8yBcRXMRQ
-Oie8V6OWV6Yx7t2KPHx1AkEAkdoOKF6xDdhLGlhKGjTabaMNd8uPTE1NQe0MqcQC
-YCGznZOzxLVF0vUjPhjE9yiFIKT/xlSQaNou6s7wUtwIXQ==
+MIICXAIBAAKBgQDufcKMDiMrfbW5UcqPRTcqIVst1uxXxfqs8Tlj021AOcxTI6Wl
+cm4a8LzlC/sNgkC0YdepG7RKVWLPTjymOWX6dPmRjLkOASvNNIendvcC3e2Bd8rV
+x5y4A6eBfsC/FDJ7glBpFQOwfF1m1NFYcAqQDJe3q2QwRV+oeieCiYiYDQIDAQAB
+AoGAZEUXoI7pFoX5+3p58ZamRN5VWYZ9Q8IHTOL2wBPKYTBryaC5KkBcLpN8t8g7
+u0hCMBTa+UyeloojywkX0sNbLgxpeY6TUurq167qtO6VavR13yw6/O+bPXgcAn7u
+dLkNPcHuekupM41f9PboHFks2y1652VZLe72C95FNB2DxwECQQD6ZdEkFjwbpSwM
+fvI2TKPoUz0mNgVebdet0ydeQlYw0qGO82Oa8n1egyu/zhP49xdLCtV/pTuXyqKJ
+77DAy+ntAkEA89O/Sxn9MI+eEvVwsVd2tTpaAKgSjmHMejxipa20DkLkwRkCoe35
+4TATN2EAHBbB4/Z+YoT4DwGR2wZjef0ioQJAeTg3UmANQ1joBTijq5PYuc0qSkhW
+uws0IauaYHB+523g1qKPcuC3vryDvnxWgO2l8idRilUEj4yCuYI3MG7HVQJASFJj
+aDRSPEgtG/R/M6r8w+6F6bHwpxjtHMiyffAS+zPuRDRV6o/60UeAO6ni7XH2mtZv
+UGueZF0T1UKE2RczYQJBAOLD27YypM6SOZKea5UXhWLmnvTmjKu3R9qqg/QI8mRN
+bDvUmU/LbNQetwaJ3uGxNo2cBxJJoGR8yD8okl8SPUk=
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ta4_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ta4_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCfRhrlCZimvc+2XCD8gteG0tCXIMYSpV9seiyaaEy6dTIJ/tWz
-W2rU+5Wqv1o2wy5XPdH0h0yKZhCJOdi5Lxo/N/oG0OJdPwaLpG6FT2SPcgX7/qoH
-9a2wScU27pbASViI9aIvO5B9uB7XsGfNuTgFjaeUjEAzCx99A9yZwVVJWQIDAQAB
-AoGAFEQkWe5dqSHP00FnxRmU+QfMGN7HtUmrma72C/Onh7Yv1svBP2AreMxGYAKX
-JQ6yz9EC7R1mJNoV0pA0vmN68ErwkdjIEi0FDkp0BmjaaN328g3HiFP4tiLtftdW
-96eqr1Sche7b9BILHbDbNRo8jnfaNp/kGf2/5wJ1GUHLVYECQQDRQlxCmZTulSjC
-1Ev40BURqKhDlhm4Cj6Nn8cU8bSBqThzPIHCPCeYh7tqVn8foQIats8PR458LMhe
-e1Uuf9kRAkEAwtmIrxLQkctTPWIUWXike/ApEUNTp7vBMgLwLXWN/HoVERdY8pBT
-HW+ESH73L5imS5gRKIbArvCYRNvL/Z4ryQJAFLM+0yvEKtHAhX1gwo06+FM5ye3I
-P4dr5rCejfjXBViLCAM9RsySkikjJgLGcoeH4MKiuv02IByB+a6zn3TwMQJBAIqz
-x3S48/eUwUBk3Q+DrbL8Fn/PaXFxWel75fS2RciALxbng83HpyLBC21/0/3xsA8H
-xM8QfYEKi5oYzHFRcuECQBS77ANtI6Lw69l7Yq7KO7Z5eVQmQgJ1KSd7gv6vQuaW
-o/ofMLlaxs1MbaLcNLDCq61JlYLS/uMhf0fL5Gv7gdY=
+MIICXgIBAAKBgQDAK/ITpSnoGe0Vt+9lKjO8qiMXB0/iuML86PA20nFV/kUVT2I9
+C/YaTmx8WQkGEG72FxyWTtbO+ri2pDaXldxJh87tEBr4yrmPPtTmiWQnAR3gVp1x
+VXvxU+sWudY89DU/pSO3UB7YDWev+2V3VTQPqc81mrzq7ct8XJ9hGpbqowIDAQAB
+AoGAFfTvc88rOpm7vP+HGsf3oVbPK5JqTj1OCheTWrAwwuKKgiTP1KnJNLhBLPP/
+U/IMu5FocsQPRxbeg/+/PRKiWJFojG5ZpFrChwuTHXvRCQOkQCJLERPJ6TytNg3l
+xsRUQ8dmwI1i1gdSAiH7QM0THbWvxrYV56sWAsmErITXNAECQQD4fzZYKQNfzJZH
+ZBisFM7HEzNC231tKeMc6Mdeen70QqG4fsjX5/C+ocixUkWyIOUtwjwE3yJvXJwL
+6gzzLSepAkEAxflcOezxcCkU7ctMQo6h6bmW+R5IL5pcwkaXuq4uVouAiLqKOb1Z
+1Q/5NEi0omTZOfLXeHGNYhFpFWBWBEb/awJBAL6UIcOfQL06FI8QD3P6SVOYQBoo
+Z5tPIqVLSYwF+lOuvoTWh4Y+lf496cNEy7r/S4S6kHlT//7UUcE5cVEW8nECQQCc
+MLzDcp2VSMQbS85RoGg7ltF2n56B9/4AxGMGxE8Itqzkso9FOI98GksZJddlW71K
+C75VZvkNiwDl/Yg/fagbAkEAqDu7IK6L5gqf+pc/PiG+UZfzDHH50wCk6RH2vd/5
+BfiQlHiVEFfFf7QtijFyEErzqFmDk0jAqGqHOf7FSxI2xg==
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/keys/ta5_key.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/keys/ta5_key.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,15 +1,15 @@
 -----BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQDAvhLc3dRBq46c+mMstzZqertxTl56cFDmN7RXdXQhRkjuLZtC
-pD9PFgXat3NKTKvBZLKonP63gtPs3oOw8CaGwNo5ypewzjxvFsMHJkcuOZSPowUh
-LMUVKZuYIxJ3OLipD65pxFSi3ANS/pkoLvD80aaRiZu2DMGbSOCZpULpCwIDAQAB
-AoGAZ4KspqkLYOk9gdiGgnEybCTVnZg07RR8nea0l3Oglm4kpKUhiLyks1hkdH2p
-EPH0G7x0plEKCovcPI2Ts+aFCVHtVtIQpQRuHWe0f6oDC6MvQxcBN6Sm4jdLfERU
-Vsp/1TlCAJaNaLfBZbxUVJkX1NoVq3H1u3nsflreW+zTSkECQQDyju9U1yB6Otta
-IchTrjqnJyqcygPnHWSViU9Z9jO9T26XUTsxanR9FIFT2Up1G1XlEBpddwrspBn9
-OF+ZJEBjAkEAy2xsebaA/Nig0OUKHWEFN0h8kvyK4q/ugQ9+lQcAi3O0Tw5LSSzt
-tws7s+2f4+5H3APKWwFlVLfCtDdv744ROQJAZ4qsj8LlkkfdqzQQl+ggEYqenh9+
-WwIpFcxvmy+GFqH5y45Zfla7M0m1i12Ocz8gA5BEMPHIMAw9K+MMrArVkQJAd0aE
-uD0NlrQCX1ncu2s23rpu6NSRLufPZfdK1mD7rcjTEYOlGyvv2mMIx7BuDvyZP+Ut
-En1YB/uTe44B4Smg6QJAOjWqRC8GeK3fyl8BWxBzy00vNQCkgft7OspPM7zD7EGs
-sujcp4G5JwuOPaZ4R7pHhWa/I7kBw9hclG6JvS8GLg==
+MIICXQIBAAKBgQCrzoWgjvBGYHXiuJA57wOoR6DXdaMJ3t2mssrhOuH7u1k2Q4Xi
+l4kjgo5uk7V2qmdWKDcaivNPUPdZUD1SnbKzKDa1scTPklbUFJU9xwR5zYiucp6a
+b0l6wqG+5TjC/GLvZasgegJ0Vg0Ji4aya4aXAwQCWHwBEh3kJwxgNCP3NQIDAQAB
+AoGAMbLmONHgc5tHvrQBFKEtf6povqsK5LoRiD1ELu8nm/hQEEBsJGYNh7YmmZok
+7hTRG706Y3U6eQFE7BMoChQQMwV0GIuLjm5LohautkpFcgB9sA8R/QQIerG99aCp
+v5BBXLRrMe/x+7KcEiqyJT4rQ7ABI7j8s2Ynj1xcZueu/AECQQDkP5vcMkP4DxpE
+scuvNyj/hfqWr9Y8Vp2pImU4sD4MwA+GShDWBu3rNS9MrwYv0K7a6T1NTuvURRCa
+XA13yp61AkEAwLIf+D+GoqbJGAN2gkR3lnYRwKC95/T13LIa5rAbzCnXxf5tLXoB
+BX0gE02IT0HAW61JZ1GJjKrrv7w+Q2LGgQJAZGhPCjjaiZ8rMRj9v2CGmpG3wN4t
+YnG//Y1x9dQiF73NloeyjFSUCSpmWleMYzBsG0ULgJy9Ra30NdNU4WOzGQJBAI6o
+kOCR71QllEUx8x+4Hq0G1le86Tt78DWmqiHViY7Z/4P2u89qPq1YmFGSGfNLY2S7
+4tcZ13KL66L0c0giLYECQQCCv/gSoin3lGqWyXWbaoLRmhzVds6KWaNGLiqjsbhU
+pmyuGpYPQj1y8uZE/ToWyJ2oGUrUe1l+UySDGOXUEqnL
 -----END RSA PRIVATE KEY-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/03.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/03.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i2_ta1/emailAddress=i2_ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta1/emailAddress=pubCA1_ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:aa:b0:34:d1:f2:16:6f:f7:d5:33:8d:45:66:2c:
-                    be:01:ec:68:c9:31:ca:ee:7f:93:fc:d6:17:13:e0:
-                    ba:fb:29:e1:70:3b:12:15:3a:b2:42:96:8b:25:d1:
-                    f3:59:64:58:fa:ad:8d:26:3b:cf:4b:88:e1:32:6f:
-                    2e:e3:69:d3:4a:4d:7e:c8:f9:5c:7a:40:a9:14:ba:
-                    0e:3e:a7:f1:d9:7f:a7:3f:de:2d:96:83:52:d7:1f:
-                    eb:ff:e9:08:66:35:d8:38:8a:15:b7:0e:5e:a5:e2:
-                    4d:e3:74:b6:1e:14:05:78:67:ed:fb:82:cc:55:c5:
-                    03:df:64:8f:09:d0:3b:c5:d3
+                    00:df:99:e1:31:21:52:4c:52:21:74:ae:ca:4d:e9:
+                    75:6d:3a:23:75:8e:9c:52:a3:3e:53:cf:fb:cd:cc:
+                    47:74:d2:8e:5d:65:57:a1:ad:1b:cf:58:23:9e:53:
+                    9d:3c:1a:46:60:98:d9:5e:3c:e5:d0:c4:cb:0c:28:
+                    59:96:5e:26:c8:1d:29:e9:01:a5:5a:3b:df:9e:1a:
+                    85:f4:9d:53:0e:19:81:20:d8:bc:3d:2a:89:e7:8c:
+                    fe:75:61:45:a5:f7:6a:7f:ad:94:a2:95:4b:58:35:
+                    2a:6f:e9:54:4b:2c:bf:07:0a:39:03:7e:c0:96:1b:
+                    9e:8f:39:fa:49:3e:d0:4f:6b
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                E8:81:62:06:D5:A6:C6:2E:6C:2A:4F:A3:21:42:59:CD:19:5B:32:ED
+                F1:31:DD:AE:13:EF:6C:62:A3:83:98:4D:1F:0D:25:1A:21:28:1E:5D
             X509v3 Authority Key Identifier: 
-                keyid:E3:6D:6B:62:16:42:41:2B:9C:3B:68:01:F3:EF:16:3C:31:83:05:41
+                keyid:4A:49:37:7B:87:42:F2:B2:3F:07:11:1E:FC:AD:31:B2:C9:DA:CD:25
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i1_ta1/emailAddress=i1_ta1
                 serial:02
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        72:ed:f0:65:97:65:56:53:3c:c8:78:ae:a1:22:70:c3:a0:1d:
-        db:42:3b:75:43:c9:b1:98:7d:7c:c4:c0:41:07:b4:18:72:26:
-        34:98:35:c1:20:17:1c:dc:53:59:a6:d9:42:01:f3:0d:9b:16:
-        f9:15:73:3f:1f:49:71:06:f0:0c:b0:49:d2:2c:89:f7:42:7f:
-        b5:37:55:fb:49:2e:2b:8e:c1:70:e3:84:96:13:ab:63:f9:70:
-        11:89:86:b7:e9:db:1e:56:dc:9a:78:3b:ad:47:30:5f:98:28:
-        8c:ea:f2:8f:af:40:b8:93:73:72:b0:be:e0:52:72:69:e8:ee:
-        52:4d
+        98:18:b3:7c:e7:02:ff:ac:b5:bd:af:2d:7e:02:5a:f2:db:fd:
+        1a:c8:31:20:44:2a:b4:78:df:87:f4:f5:5d:f0:bb:ee:97:d0:
+        45:db:10:2b:e3:1c:96:45:7b:d1:7c:d7:95:d8:f7:13:d1:2e:
+        da:59:09:68:6c:1f:f1:b7:b6:c4:1b:3c:89:38:9e:ff:5a:74:
+        53:18:56:3b:9e:ba:c2:a6:e3:f0:94:85:6a:89:bb:7c:f3:a8:
+        8e:33:c5:54:d1:e1:4c:31:b6:c8:4d:e0:62:36:d6:83:a3:08:
+        c4:e7:c4:5c:20:61:b4:8b:5c:05:2c:8c:28:b1:83:2f:68:e8:
+        16:92
 -----BEGIN CERTIFICATE-----
-MIIDKTCCApKgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
+MIIDOTCCAqKgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEPMA0GA1UEAxQGaTJfdGExMRUwEwYJKoZIhvcNAQkBFgZpMl90YTEw
-HhcNMTAwODA0MjA1OTIzWhcNMTMwNDMwMjA1OTIzWjB2MQswCQYDVQQGEwJVUzET
+HhcNMTEwMTI4MDI1NDEwWhcNMTMxMDI0MDI1NDEwWjB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMTEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqrA00fIWb/fVM41F
-Ziy+AexoyTHK7n+T/NYXE+C6+ynhcDsSFTqyQpaLJdHzWWRY+q2NJjvPS4jhMm8u
-42nTSk1+yPlcekCpFLoOPqfx2X+nP94tloNS1x/r/+kIZjXYOIoVtw5epeJN43S2
-HhQFeGft+4LMVcUD32SPCdA7xdMCAwEAAaOBzjCByzAdBgNVHQ4EFgQU6IFiBtWm
-xi5sKk+jIUJZzRlbMu0wgZgGA1UdIwSBkDCBjYAU421rYhZCQSucO2gB8+8WPDGD
-BUGhcqRwMG4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYD
+Q0ExX3RhMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA35nhMSFSTFIhdK7K
+Tel1bTojdY6cUqM+U8/7zcxHdNKOXWVXoa0bz1gjnlOdPBpGYJjZXjzl0MTLDChZ
+ll4myB0p6QGlWjvfnhqF9J1TDhmBINi8PSqJ54z+dWFFpfdqf62UopVLWDUqb+lU
+Syy/Bwo5A37Alhuejzn6ST7QT2sCAwEAAaOB3jCB2zAdBgNVHQ4EFgQU8THdrhPv
+bGKjg5hNHw0lGiEoHl0wgZgGA1UdIwSBkDCBjYAUSkk3e4dC8rI/BxEe/K0xssna
+zSWhcqRwMG4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYD
 VQQHEwpNZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQ8wDQYDVQQDFAZpMV90YTEx
-FTATBgkqhkiG9w0BCQEWBmkxX3RhMYIBAjAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
-SIb3DQEBCwUAA4GBAHLt8GWXZVZTPMh4rqEicMOgHdtCO3VDybGYfXzEwEEHtBhy
-JjSYNcEgFxzcU1mm2UIB8w2bFvkVcz8fSXEG8AywSdIsifdCf7U3VftJLiuOwXDj
-hJYTq2P5cBGJhrfp2x5W3Jp4O61HMF+YKIzq8o+vQLiTc3KwvuBScmno7lJN
+FTATBgkqhkiG9w0BCQEWBmkxX3RhMYIBAjAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
+DwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOBgQCYGLN85wL/rLW9ry1+Alry2/0a
+yDEgRCq0eN+H9PVd8Lvul9BF2xAr4xyWRXvRfNeV2PcT0S7aWQlobB/xt7bEGzyJ
+OJ7/WnRTGFY7nrrCpuPwlIVqibt886iOM8VU0eFMMbbITeBiNtaDowjE58RcIGG0
+i1wFLIwosYMvaOgWkg==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/0C.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/0C.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:bd:ef:e1:5e:a1:32:ff:ee:9b:64:1a:a3:f0:e2:
-                    63:64:ab:7d:60:5e:32:60:36:f5:67:54:d0:e0:13:
-                    6e:ef:88:c1:ff:0e:64:d2:f4:cc:07:fd:18:03:90:
-                    fb:73:b7:91:c9:9e:97:b2:b0:0a:ae:9f:88:dc:29:
-                    fd:2c:19:09:43:ef:68:7c:ab:de:91:de:51:cb:e2:
-                    35:fc:96:fe:13:e9:3c:ea:97:3c:2a:ef:92:9a:31:
-                    77:e4:a2:24:40:01:6e:a0:59:ef:7e:71:d9:be:5a:
-                    3f:ed:7e:b6:d5:7b:38:6d:4c:16:f8:fd:ec:fb:6f:
-                    8c:41:fb:fd:dc:0c:54:1c:db
+                    00:dd:e0:f7:ca:f9:42:6a:e9:28:bf:8c:08:48:4c:
+                    17:fc:35:c5:2c:0c:b4:07:7c:c1:c4:05:bb:88:15:
+                    2f:25:23:db:41:b0:24:8e:54:3b:44:02:4b:8f:60:
+                    3b:13:ef:f9:7d:8d:5d:dc:34:b3:13:b9:28:5d:3c:
+                    4b:c1:76:6c:ae:ff:a3:7a:44:71:76:f9:0b:1a:cc:
+                    df:5a:37:9c:b3:12:eb:38:99:3b:85:f7:eb:13:93:
+                    34:02:4b:54:7c:52:fd:ad:58:46:70:af:7b:2d:7f:
+                    56:5a:f3:95:66:5a:52:2a:da:c3:b2:98:7b:2f:cd:
+                    44:2f:2d:24:c9:6a:29:90:fd
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                47:D6:CB:F2:38:3E:A8:40:85:4A:BE:EF:F8:85:B3:49:FF:D0:8F:16
+                C1:F8:27:0B:0D:24:82:11:16:5F:44:79:21:5A:E7:BF:F8:2E:7F:61
             X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
+                serial:98:29:8D:38:A1:E7:D1:02
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        6a:25:8d:33:01:c1:a0:fe:99:5f:f0:b4:8a:39:86:55:f5:6c:
-        59:2a:84:a5:01:10:dd:1a:b6:a2:52:17:62:e1:e5:d5:8a:e9:
-        09:bd:04:95:b1:a4:b3:ec:9b:73:f3:54:12:26:97:a5:1e:52:
-        9e:bf:93:c7:4d:dd:a3:c4:ec:0b:46:3e:e4:b7:c3:47:17:68:
-        15:df:a1:1a:67:c0:8b:f6:a8:ea:ab:81:6a:fc:a3:4c:5b:0e:
-        ca:cc:b7:bf:e5:35:73:e9:95:d0:ad:8c:fc:2a:7d:2c:ee:6b:
-        09:53:2f:f3:9b:57:fa:32:bb:02:f9:10:fa:30:a2:e3:55:0c:
-        4a:73
+        17:cc:85:98:2b:c5:c8:ce:30:6a:c8:99:c8:d5:41:68:37:12:
+        e3:63:2d:47:33:b0:46:78:f7:c4:3a:cf:84:c9:5b:03:61:19:
+        40:69:7e:63:00:16:9d:15:73:39:1e:c3:e1:f6:fe:a5:88:5b:
+        86:c1:3e:9b:c4:ce:34:6b:51:a1:2b:47:6c:ae:17:c3:b4:c5:
+        b4:be:14:47:0a:a3:f3:c5:fb:bb:85:4e:31:74:28:cf:fa:9d:
+        71:e0:93:68:c9:e4:83:33:1d:80:76:2d:cf:38:5b:4d:3e:e5:
+        16:0a:13:d4:ce:31:d9:b3:7b:6d:10:7f:6a:60:39:8a:ff:f2:
+        22:a5
 -----BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBDDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDNTCCAp6gAwIBAgIBDDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTAw
-ODA0MjA1OTI1WhcNMTMwNDMwMjA1OTI1WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTEw
+MTI4MDI1NDEzWhcNMTMxMDI0MDI1NDEzWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAve/hXqEy/+6bZBqj8OJjZKt9
-YF4yYDb1Z1TQ4BNu74jB/w5k0vTMB/0YA5D7c7eRyZ6XsrAKrp+I3Cn9LBkJQ+9o
-fKvekd5Ry+I1/Jb+E+k86pc8Ku+SmjF35KIkQAFuoFnvfnHZvlo/7X621Xs4bUwW
-+P3s+2+MQfv93AxUHNsCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUR9bL8jg+qECFSr7v
-+IWzSf/QjxYwgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRq
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3eD3yvlCaukov4wISEwX/DXF
+LAy0B3zBxAW7iBUvJSPbQbAkjlQ7RAJLj2A7E+/5fY1d3DSzE7koXTxLwXZsrv+j
+ekRxdvkLGszfWjecsxLrOJk7hffrE5M0AktUfFL9rVhGcK97LX9WWvOVZlpSKtrD
+sph7L81ELy0kyWopkP0CAwEAAaOB4DCB3TAdBgNVHQ4EFgQUwfgnCw0kghEWX0R5
+IVrnv/guf2EwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
 MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
 ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
-9w0BCQEWA3RhM4IJAOH4Ui+s9ADuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAaiWNMwHBoP6ZX/C0ijmGVfVsWSqEpQEQ3Rq2olIXYuHl1YrpCb0E
-lbGks+ybc/NUEiaXpR5Snr+Tx03do8TsC0Y+5LfDRxdoFd+hGmfAi/ao6quBavyj
-TFsOysy3v+U1c+mV0K2M/Cp9LO5rCVMv85tX+jK7AvkQ+jCi41UMSnM=
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABfMhZgrxcjOMGrImcjVQWg3EuNjLUcz
+sEZ498Q6z4TJWwNhGUBpfmMAFp0Vczkew+H2/qWIW4bBPpvEzjRrUaErR2yuF8O0
+xbS+FEcKo/PF+7uFTjF0KM/6nXHgk2jJ5IMzHYB2Lc84W00+5RYKE9TOMdmze20Q
+f2pgOYr/8iKl
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/11.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,55 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 17 (0x11)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
-        Validity
-            Not Before: Aug  4 20:59:27 2010 GMT
-            Not After : Apr 30 20:59:27 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta3/emailAddress=pubCA2_ta3
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:91:27:b7:93:9d:5d:e5:9e:e9:5d:78:e2:1d:ff:
-                    73:0e:d7:a7:4e:a3:bf:e3:ff:33:08:c9:a9:e4:6f:
-                    bc:a5:b9:33:32:29:8f:da:d1:63:51:0c:3b:da:84:
-                    32:bb:74:28:70:d3:07:3b:3d:ac:2f:7d:c2:9e:4a:
-                    4e:7c:34:37:e6:1d:76:aa:44:a0:56:c9:83:83:13:
-                    7e:67:91:99:af:5d:5a:36:5d:a6:20:23:4a:f5:a8:
-                    08:12:5e:49:52:4b:ae:d3:e6:b4:63:f8:2e:1d:80:
-                    5f:bd:1f:58:75:34:92:ce:be:6a:3b:f8:25:fd:64:
-                    49:b6:fe:6b:03:dc:0c:9e:4f
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 Issuer Alternative Name: critical
-                <EMPTY>
-
-    Signature Algorithm: sha256WithRSAEncryption
-        07:01:15:2c:e6:eb:e6:8a:b4:dc:6c:fa:f5:30:2d:32:e1:6f:
-        27:76:6d:1e:c8:4b:e1:ae:f8:96:fb:15:0e:0e:8f:e7:fe:43:
-        d3:af:f7:b3:f8:19:e0:77:38:43:d3:6b:86:6b:f1:b6:36:b5:
-        34:66:49:ad:c0:58:7a:40:18:da:48:af:b4:b3:24:43:92:06:
-        df:84:c2:ac:ea:c1:0d:8a:82:86:39:ce:44:1e:72:f2:46:0e:
-        c4:cf:70:78:86:a9:8f:35:83:5f:74:e1:30:a3:90:29:f2:f2:
-        5f:d1:d3:84:84:4d:1d:08:ea:05:24:2d:d0:ae:3d:0f:78:7c:
-        c7:10
------BEGIN CERTIFICATE-----
-MIICdTCCAd6gAwIBAgIBETANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTAw
-ODA0MjA1OTI3WhcNMTMwNDMwMjA1OTI3WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
-CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
-NTETMBEGA1UEAxQKcHViQ0EyX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0EyX3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAkSe3k51d5Z7pXXjiHf9zDten
-TqO/4/8zCMmp5G+8pbkzMimP2tFjUQw72oQyu3QocNMHOz2sL33CnkpOfDQ35h12
-qkSgVsmDgxN+Z5GZr11aNl2mICNK9agIEl5JUkuu0+a0Y/guHYBfvR9YdTSSzr5q
-O/gl/WRJtv5rA9wMnk8CAwEAAaMhMB8wDwYDVR0TAQH/BAUwAwEB/zAMBgNVHRIB
-Af8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAAcBFSzm6+aKtNxs+vUwLTLhbyd2bR7I
-S+Gu+Jb7FQ4Oj+f+Q9Ov97P4GeB3OEPTa4Zr8bY2tTRmSa3AWHpAGNpIr7SzJEOS
-Bt+EwqzqwQ2KgoY5zkQecvJGDsTPcHiGqY81g1904TCjkCny8l/R04SETR0I6gUk
-LdCuPQ94fMcQ
------END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/13.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,62 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 19 (0x13)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
-        Validity
-            Not Before: Jan  1 01:01:01 2009 GMT
-            Not After : Jan  2 01:01:01 2009 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA3_ta3/emailAddress=pubCA3_ta3
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:95:a3:85:b5:71:f3:2f:b2:aa:c2:33:ff:4c:70:
-                    40:e1:06:44:e8:7c:0f:78:77:21:1d:a6:8a:e7:0c:
-                    e7:65:12:f5:cc:99:cf:4a:00:bd:5e:ea:4d:c7:a3:
-                    85:93:0c:4c:4a:17:44:49:d9:b9:06:45:b4:99:d0:
-                    95:08:aa:f6:c4:07:75:46:a7:26:3a:e5:01:64:26:
-                    74:c7:58:73:e9:70:4f:97:15:4e:30:bd:55:8e:cb:
-                    43:33:36:8a:f9:cc:57:e6:ee:2a:1b:aa:0e:67:51:
-                    c5:52:61:ab:43:5b:f2:d7:2c:20:5c:c1:72:a4:3a:
-                    bb:b0:a2:3b:b4:6e:e3:b9:df
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                E9:26:60:80:D1:41:FF:4A:A4:0C:14:05:C0:6B:5D:84:C5:F0:15:04
-            X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
-                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
-
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-    Signature Algorithm: sha256WithRSAEncryption
-        7f:d0:e5:cc:61:28:7a:14:1f:6e:43:f2:1f:98:55:8f:3f:9b:
-        f4:8c:1d:2d:4d:c4:c5:08:2f:eb:1a:6d:1d:99:80:57:3b:45:
-        d3:4f:71:6f:61:ca:17:83:9f:23:5f:0a:77:7b:25:b2:53:2b:
-        ca:e3:3d:ad:28:57:99:b9:3a:d8:f8:d2:3f:55:d8:f4:ef:94:
-        81:36:58:4f:98:a0:2b:6b:8d:77:cb:3d:bd:32:9a:5e:dd:1e:
-        7f:4f:02:fe:de:35:a8:f0:85:3a:eb:a9:22:5a:dd:9d:ba:dc:
-        40:b7:9f:ba:54:f8:84:7d:39:42:ec:87:73:85:11:1d:36:41:
-        9f:e7
------BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBEzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMDkw
-MTAxMDEwMTAxWhcNMDkwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
-CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
-NTETMBEGA1UEAxQKcHViQ0EzX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0EzX3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAlaOFtXHzL7KqwjP/THBA4QZE
-6HwPeHchHaaK5wznZRL1zJnPSgC9XupNx6OFkwxMShdESdm5BkW0mdCVCKr2xAd1
-RqcmOuUBZCZ0x1hz6XBPlxVOML1VjstDMzaK+cxX5u4qG6oOZ1HFUmGrQ1vy1ywg
-XMFypDq7sKI7tG7jud8CAwEAAaOB0DCBzTAdBgNVHQ4EFgQU6SZggNFB/0qkDBQF
-wGtdhMXwFQQwgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRq
-MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
-ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
-9w0BCQEWA3RhM4IJAOH4Ui+s9ADuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAf9DlzGEoehQfbkPyH5hVjz+b9IwdLU3ExQgv6xptHZmAVztF009x
-b2HKF4OfI18Kd3slslMryuM9rShXmbk62PjSP1XY9O+UgTZYT5igK2uNd8s9vTKa
-Xt0ef08C/t41qPCFOuupIlrdnbrcQLefulT4hH05QuyHc4URHTZBn+c=
------END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/15.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,62 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 21 (0x15)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
-        Validity
-            Not Before: Jan  1 01:01:01 2035 GMT
-            Not After : Jan  2 01:01:01 2035 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA4_ta3/emailAddress=pubCA4_ta3
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:b2:8a:7a:22:17:a3:be:ff:35:73:f1:13:34:e2:
-                    c1:02:e3:1e:a6:d8:bc:c2:29:a6:9d:e1:96:0b:2b:
-                    38:42:db:f4:9f:f8:05:c0:d9:81:ab:37:35:da:24:
-                    1b:e5:95:6b:c5:da:e8:c1:14:c3:c7:3e:a4:20:ce:
-                    25:75:5f:13:d4:94:4d:7c:69:42:82:ef:09:c9:b1:
-                    11:dd:a0:d9:e2:76:47:fd:68:e7:ec:11:02:f7:a6:
-                    92:da:50:b8:9d:e8:90:9d:f7:e2:d6:cd:35:7e:1c:
-                    f6:31:71:39:fe:1a:5d:49:cc:50:c7:34:fd:cb:e1:
-                    85:3a:e4:a6:15:9a:7f:6b:c5
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                A5:56:E6:44:AE:89:5C:8E:24:C2:58:B6:C6:D1:7B:51:BC:F4:7A:83
-            X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
-                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
-
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-    Signature Algorithm: sha256WithRSAEncryption
-        65:98:33:cd:b4:af:b0:67:bf:0e:8e:0e:d6:8c:fd:a6:7c:18:
-        88:a7:2a:ac:55:5d:b3:95:f3:8f:5f:d7:00:78:cc:fd:00:6a:
-        0c:75:12:00:7b:88:f4:93:66:00:be:c7:ce:d7:75:72:0e:44:
-        3e:fc:b2:ff:d1:23:72:9c:be:a7:a7:70:d9:af:0d:e5:84:43:
-        77:6e:73:60:ff:40:f0:f6:94:17:8e:4e:57:0d:d6:35:4f:5b:
-        46:d6:36:6e:3a:03:e6:13:b9:4c:c9:fd:75:c7:e6:4f:f3:75:
-        bc:2a:38:dd:7c:9b:3c:5a:75:27:c9:00:5d:11:11:b6:4e:e9:
-        97:b9
------BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBFTANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMzUw
-MTAxMDEwMTAxWhcNMzUwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
-CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
-NTETMBEGA1UEAxQKcHViQ0E0X3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0E0X3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsop6Ihejvv81c/ETNOLBAuMe
-pti8wimmneGWCys4Qtv0n/gFwNmBqzc12iQb5ZVrxdrowRTDxz6kIM4ldV8T1JRN
-fGlCgu8JybER3aDZ4nZH/Wjn7BEC96aS2lC4neiQnffi1s01fhz2MXE5/hpdScxQ
-xzT9y+GFOuSmFZp/a8UCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUpVbmRK6JXI4kwli2
-xtF7Ubz0eoMwgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRq
-MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
-ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
-9w0BCQEWA3RhM4IJAOH4Ui+s9ADuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAZZgzzbSvsGe/Do4O1oz9pnwYiKcqrFVds5Xzj1/XAHjM/QBqDHUS
-AHuI9JNmAL7Hztd1cg5EPvyy/9Ejcpy+p6dw2a8N5YRDd25zYP9A8PaUF45OVw3W
-NU9bRtY2bjoD5hO5TMn9dcfmT/N1vCo43XybPFp1J8kAXRERtk7pl7k=
------END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/16.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,55 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 22 (0x16)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
+        Validity
+            Not Before: Jan 28 02:54:20 2011 GMT
+            Not After : Oct 24 02:54:20 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta3/emailAddress=pubCA2_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b8:c0:ed:3f:ee:b2:c4:82:85:82:6e:dc:d2:63:
+                    72:d9:d7:73:bf:24:bc:5a:ab:9a:aa:39:dc:01:23:
+                    95:40:8b:1c:c4:08:e1:3a:20:a9:f3:21:e4:ca:e9:
+                    c8:be:48:52:34:35:5f:af:19:60:89:7a:4f:95:e2:
+                    c2:dc:0a:f2:7a:7d:62:ce:d5:39:55:4e:10:d8:da:
+                    90:48:73:69:64:ef:7d:a9:57:a2:f2:6d:e6:db:d0:
+                    a3:df:2a:a1:c1:f4:c6:44:32:bc:af:d9:bb:5e:c1:
+                    39:10:27:fd:1e:6e:9f:dc:65:63:1c:9c:bd:3b:b1:
+                    8f:9a:da:82:6e:5b:71:a0:97
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Issuer Alternative Name: critical
+                <EMPTY>
+
+    Signature Algorithm: sha256WithRSAEncryption
+        bd:39:e7:46:37:ef:db:c9:d2:d5:af:3e:ac:5d:36:b3:c8:55:
+        3f:3a:5c:cb:54:33:bb:46:ad:90:a5:5b:29:87:31:c1:f2:7c:
+        b0:15:99:93:ce:70:3c:7d:59:8d:3e:ba:ae:f6:77:ae:ee:21:
+        0e:6b:12:de:7c:f7:12:1e:94:81:77:01:ee:3b:15:86:28:f0:
+        13:64:2f:24:fa:15:71:02:53:93:9c:aa:a6:55:f9:75:eb:27:
+        f8:09:09:af:7f:77:bf:5c:38:b1:ce:e6:46:60:36:16:83:59:
+        0d:f0:b5:b5:97:82:a7:43:d4:b5:6f:85:cd:77:4f:59:73:49:
+        9c:cb
+-----BEGIN CERTIFICATE-----
+MIICdTCCAd6gAwIBAgIBFjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTEw
+MTI4MDI1NDIwWhcNMTMxMDI0MDI1NDIwWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0EyX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0EyX3Rh
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuMDtP+6yxIKFgm7c0mNy2ddz
+vyS8WquaqjncASOVQIscxAjhOiCp8yHkyunIvkhSNDVfrxlgiXpPleLC3Aryen1i
+ztU5VU4Q2NqQSHNpZO99qVei8m3m29Cj3yqhwfTGRDK8r9m7XsE5ECf9Hm6f3GVj
+HJy9O7GPmtqCbltxoJcCAwEAAaMhMB8wDwYDVR0TAQH/BAUwAwEB/zAMBgNVHRIB
+Af8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAL0550Y379vJ0tWvPqxdNrPIVT86XMtU
+M7tGrZClWymHMcHyfLAVmZPOcDx9WY0+uq72d67uIQ5rEt589xIelIF3Ae47FYYo
+8BNkLyT6FXECU5OcqqZV+XXrJ/gJCa9/d79cOLHO5kZgNhaDWQ3wtbWXgqdD1LVv
+hc13T1lzSZzL
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/17.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,62 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 23 (0x17)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
-        Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:b4:f4:b1:9f:49:97:92:18:a9:fa:94:37:f9:45:
-                    5f:31:c4:2d:f6:19:fe:9a:ac:4d:bb:da:7d:99:0c:
-                    e1:f0:b2:0f:9b:b8:c5:ba:58:f8:3e:52:7d:83:17:
-                    c2:7a:f9:ae:f6:26:75:9f:17:9a:8a:0b:a0:2c:38:
-                    d4:fc:ac:02:7f:1b:2e:c9:92:da:79:21:10:5b:7c:
-                    56:3c:de:7e:64:52:73:42:5c:1b:44:94:8b:16:de:
-                    ab:eb:b3:6d:8a:41:11:c7:7e:06:93:fa:a6:9b:00:
-                    1d:ec:d4:cd:07:69:46:4b:7e:60:7f:4b:93:f6:8d:
-                    c5:07:fe:0b:44:a8:3c:db:a5
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                EE:8D:78:53:11:FE:07:CB:C8:55:4B:EF:A6:2F:E1:83:72:BB:BA:21
-            X509v3 Authority Key Identifier: 
-                keyid:FE:14:53:EF:9C:0B:AB:ED:96:22:70:11:C2:E6:7D:2E:40:B7:7F:B5
-                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:C0:C8:77:B4:4C:49:4F:AB
-
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-    Signature Algorithm: sha256WithRSAEncryption
-        5c:2c:f2:7c:8d:72:aa:d1:e2:20:a2:c6:76:84:44:b9:6e:54:
-        2c:39:95:99:a9:50:bb:1c:b9:9e:8e:04:92:b5:b6:95:17:92:
-        a8:0b:09:3e:f5:5a:10:99:5a:27:2f:0f:03:4b:ea:bd:2b:bb:
-        b5:1e:51:5b:2f:7f:67:15:88:4a:e0:38:53:50:91:8c:4f:fb:
-        38:bd:52:43:37:19:3f:5b:c0:db:ed:68:90:a7:6e:28:82:2b:
-        6a:a3:08:01:23:4b:1b:3e:b0:4e:02:a6:9b:6f:f4:57:c9:41:
-        7d:66:d9:00:c1:8d:1c:73:96:01:61:b6:92:2b:ac:e8:42:8f:
-        79:29
------BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBFzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGE0MRIwEAYJKoZIhvcNAQkBFgN0YTQwHhcNMTAw
-ODA0MjA1OTI4WhcNMTMwNDMwMjA1OTI4WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
-CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
-NTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
-NDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtPSxn0mXkhip+pQ3+UVfMcQt
-9hn+mqxNu9p9mQzh8LIPm7jFulj4PlJ9gxfCevmu9iZ1nxeaigugLDjU/KwCfxsu
-yZLaeSEQW3xWPN5+ZFJzQlwbRJSLFt6r67NtikERx34Gk/qmmwAd7NTNB2lGS35g
-f0uT9o3FB/4LRKg826UCAwEAAaOB0DCBzTAdBgNVHQ4EFgQU7o14UxH+B8vIVUvv
-pi/hg3K7uiEwgZoGA1UdIwSBkjCBj4AU/hRT75wLq+2WInARwuZ9LkC3f7WhbKRq
-MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
-ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG
-9w0BCQEWA3RhNIIJAMDId7RMSU+rMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAXCzyfI1yqtHiIKLGdoREuW5ULDmVmalQuxy5no4EkrW2lReSqAsJ
-PvVaEJlaJy8PA0vqvSu7tR5RWy9/ZxWISuA4U1CRjE/7OL1SQzcZP1vA2+1okKdu
-KIIraqMIASNLGz6wTgKmm2/0V8lBfWbZAMGNHHOWAWG2kius6EKPeSk=
------END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/18.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,65 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 24 (0x18)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
+        Validity
+            Not Before: Jan  1 01:01:01 2009 GMT
+            Not After : Jan  2 01:01:01 2009 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA3_ta3/emailAddress=pubCA3_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ba:b1:90:f4:fa:4e:82:56:04:92:7a:d5:d7:23:
+                    93:e4:53:47:c2:28:06:c3:a1:6e:ed:7c:02:0e:f6:
+                    73:0b:8e:11:75:33:f3:d1:98:c0:ad:37:12:b8:41:
+                    1a:57:12:95:5e:63:61:b5:69:97:60:07:6c:6e:4b:
+                    a5:19:0e:f8:ba:35:9d:7a:f0:5c:74:33:7a:78:24:
+                    cd:2f:2a:cd:31:84:17:0f:e0:4d:06:ba:92:7a:ae:
+                    d0:a9:54:80:f1:d2:4d:dc:e9:81:84:ad:c9:74:c0:
+                    88:e8:67:63:70:2a:c4:85:75:b8:32:a8:ed:af:2a:
+                    6b:63:53:97:27:d3:9d:e6:57
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A2:91:E3:9A:3E:C3:FD:0E:04:36:9A:5C:34:32:84:C4:91:83:7A:91
+            X509v3 Authority Key Identifier: 
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
+                serial:98:29:8D:38:A1:E7:D1:02
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+        03:8e:b8:b8:48:41:bd:75:34:8c:80:37:f3:6a:54:32:9a:dd:
+        ef:55:e7:fc:b9:87:c3:1e:28:82:3c:09:09:9a:4d:d8:8e:25:
+        7b:4e:bb:b4:e9:45:61:27:25:0b:70:7a:1c:7d:14:da:4a:ff:
+        bc:9f:1c:39:47:53:b9:a3:41:b1:15:e5:f7:01:b9:0e:8b:5f:
+        a0:31:5e:4e:7d:d4:f0:ba:be:a1:b9:b3:25:d8:bb:b7:3c:0c:
+        c9:a1:2e:60:d6:4f:21:a0:6e:2e:1b:40:dd:8c:ee:07:5c:21:
+        88:f7:40:3e:4b:3d:7f:00:bf:41:89:b1:1c:45:04:49:c3:92:
+        f8:a5
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAp6gAwIBAgIBGDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMDkw
+MTAxMDEwMTAxWhcNMDkwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0EzX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0EzX3Rh
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAurGQ9PpOglYEknrV1yOT5FNH
+wigGw6Fu7XwCDvZzC44RdTPz0ZjArTcSuEEaVxKVXmNhtWmXYAdsbkulGQ74ujWd
+evBcdDN6eCTNLyrNMYQXD+BNBrqSeq7QqVSA8dJN3OmBhK3JdMCI6GdjcCrEhXW4
+MqjtryprY1OXJ9Od5lcCAwEAAaOB4DCB3TAdBgNVHQ4EFgQUopHjmj7D/Q4ENppc
+NDKExJGDepEwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
+MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
+ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAAOOuLhIQb11NIyAN/NqVDKa3e9V5/y5
+h8MeKII8CQmaTdiOJXtOu7TpRWEnJQtwehx9FNpK/7yfHDlHU7mjQbEV5fcBuQ6L
+X6AxXk591PC6vqG5syXYu7c8DMmhLmDWTyGgbi4bQN2M7gdcIYj3QD5LPX8Av0GJ
+sRxFBEnDkvil
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/1A.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,65 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 26 (0x1a)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
+        Validity
+            Not Before: Jan  1 01:01:01 2035 GMT
+            Not After : Jan  2 01:01:01 2035 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA4_ta3/emailAddress=pubCA4_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ca:aa:c4:0b:75:27:b8:a2:03:80:fd:5b:9d:db:
+                    1d:d1:69:1b:4e:bb:7d:c6:88:db:b6:14:5d:f6:f2:
+                    ff:45:f3:b6:74:7f:35:b6:a1:97:49:5e:8a:bc:94:
+                    36:25:d1:35:34:34:55:0a:e0:7f:e3:c1:1b:fe:27:
+                    ee:33:53:02:3b:a1:a7:99:ed:f1:d1:b8:1a:91:16:
+                    ba:83:9c:02:0d:78:0c:1c:79:59:74:bc:f1:0b:21:
+                    1a:fa:aa:55:72:a5:b4:39:99:40:1c:77:da:17:d6:
+                    6f:a2:14:61:96:5f:c5:14:d8:6c:ec:82:f9:b4:45:
+                    76:68:b2:a9:07:ee:94:df:65
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                04:46:EB:13:B6:FE:E1:94:6D:9C:0E:59:20:4B:A2:6C:B1:DA:68:5C
+            X509v3 Authority Key Identifier: 
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
+                serial:98:29:8D:38:A1:E7:D1:02
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+        06:1e:6c:15:d0:cd:28:6a:c2:c1:0e:3c:f5:8c:4e:0d:ec:53:
+        a6:d9:f0:28:06:df:e6:a6:ed:f7:e5:ab:a1:2a:02:f8:17:29:
+        1e:54:ec:83:44:ce:a5:ed:ee:70:33:83:83:1e:31:81:2b:72:
+        ee:4d:cd:d5:9c:9c:f3:0d:81:fd:5a:26:1c:c6:3b:27:a9:18:
+        41:96:ee:6b:bc:b4:06:72:1e:97:44:78:21:45:19:1d:38:8b:
+        69:8e:9e:d8:0f:7a:a4:4e:bb:49:8a:a9:37:5c:a5:98:6b:ad:
+        f3:29:f3:8c:53:10:1c:af:d9:5f:2a:c7:9a:f8:d5:ce:b1:ba:
+        dc:8d
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAp6gAwIBAgIBGjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMzUw
+MTAxMDEwMTAxWhcNMzUwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0E0X3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0E0X3Rh
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyqrEC3UnuKIDgP1bndsd0Wkb
+Trt9xojbthRd9vL/RfO2dH81tqGXSV6KvJQ2JdE1NDRVCuB/48Eb/ifuM1MCO6Gn
+me3x0bgakRa6g5wCDXgMHHlZdLzxCyEa+qpVcqW0OZlAHHfaF9ZvohRhll/FFNhs
+7IL5tEV2aLKpB+6U32UCAwEAAaOB4DCB3TAdBgNVHQ4EFgQUBEbrE7b+4ZRtnA5Z
+IEuibLHaaFwwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
+MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
+ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAAYebBXQzShqwsEOPPWMTg3sU6bZ8CgG
+3+am7fflq6EqAvgXKR5U7INEzqXt7nAzg4MeMYErcu5NzdWcnPMNgf1aJhzGOyep
+GEGW7mu8tAZyHpdEeCFFGR04i2mOntgPeqROu0mKqTdcpZhrrfMp84xTEByv2V8q
+x5r41c6xutyN
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/1B.pem	Tue Feb 08 18:59:49 2011 -0800
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,67 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 27 (0x1b)
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta5/emailAddress=ta5
-        Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
-        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta5/emailAddress=pubCA1_ta5
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-            RSA Public Key: (1024 bit)
-                Modulus (1024 bit):
-                    00:f1:eb:41:9f:0b:f5:8c:66:1f:8c:5d:e0:9a:a6:
-                    d3:3c:a6:af:66:36:e2:5c:8b:c4:a7:ff:fb:6f:f0:
-                    65:33:b2:a2:f2:8a:1c:94:ad:de:96:d7:7a:75:78:
-                    e1:5f:a8:c9:51:08:ff:38:df:2e:cf:37:b2:a8:e4:
-                    82:60:55:d5:40:bc:a0:b3:94:a4:59:51:ad:d8:26:
-                    64:ce:d5:54:10:5a:78:52:f1:f8:bc:d6:dc:a7:40:
-                    57:82:4f:2f:09:16:de:5b:88:42:aa:67:3e:1f:8b:
-                    b7:6e:a9:1e:6a:12:a8:35:9f:28:85:23:29:3a:20:
-                    0e:cd:89:3e:73:40:e8:d6:1b
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier: 
-                B7:AD:D9:89:4D:93:68:D0:D6:CB:4B:DB:6D:D6:CB:03:74:85:4B:AC
-            X509v3 Authority Key Identifier: 
-                keyid:AA:44:3A:A2:05:A2:04:EB:62:E0:E5:F5:2C:44:CA:3B:CF:4D:B2:74
-                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta5/emailAddress=ta5
-                serial:CB:2A:36:97:17:4F:60:24
-
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-            X509v3 CRL Distribution Points: 
-                URI:http://localhost:12001/file/0/ta5_crl.pem
-
-    Signature Algorithm: sha256WithRSAEncryption
-        93:e0:33:e4:90:54:94:6c:cb:82:8d:18:16:ef:e5:b4:80:16:
-        21:f9:f0:6e:5f:63:36:76:c1:c0:37:13:ca:df:e2:6d:f4:30:
-        5c:10:5c:86:fb:7b:dc:6f:7f:be:d5:ed:9b:65:fc:14:d2:f3:
-        8c:df:21:db:65:88:60:7b:fc:3c:6f:c8:6b:fe:5d:c7:7e:b4:
-        c7:75:54:89:0d:01:4a:0d:1a:f1:f2:5c:65:c7:12:16:98:dd:
-        f7:89:42:6a:85:a4:a6:3c:19:22:bb:99:b6:7e:d2:2a:c7:80:
-        67:6b:0f:ce:f0:c9:1b:a5:5d:39:f4:f2:f0:eb:48:ea:c0:89:
-        b0:df
------BEGIN CERTIFICATE-----
-MIIDYzCCAsygAwIBAgIBGzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
-MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGE1MRIwEAYJKoZIhvcNAQkBFgN0YTUwHhcNMTAw
-ODA0MjA1OTI5WhcNMTMwNDMwMjA1OTI5WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
-CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
-NTETMBEGA1UEAxQKcHViQ0ExX3RhNTEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
-NTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA8etBnwv1jGYfjF3gmqbTPKav
-ZjbiXIvEp//7b/BlM7Ki8ooclK3eltd6dXjhX6jJUQj/ON8uzzeyqOSCYFXVQLyg
-s5SkWVGt2CZkztVUEFp4UvH4vNbcp0BXgk8vCRbeW4hCqmc+H4u3bqkeahKoNZ8o
-hSMpOiAOzYk+c0Do1hsCAwEAAaOCAQ0wggEJMB0GA1UdDgQWBBS3rdmJTZNo0NbL
-S9tt1ssDdIVLrDCBmgYDVR0jBIGSMIGPgBSqRDqiBaIE62Lg5fUsRMo7z02ydKFs
-pGowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzARBgNVBAcT
-Ck1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDDAKBgNVBAMTA3RhNTESMBAGCSqG
-SIb3DQEJARYDdGE1ggkAyyo2lxdPYCQwDwYDVR0TAQH/BAUwAwEB/zA6BgNVHR8E
-MzAxMC+gLaArhilodHRwOi8vbG9jYWxob3N0OjEyMDAxL2ZpbGUvMC90YTVfY3Js
-LnBlbTANBgkqhkiG9w0BAQsFAAOBgQCT4DPkkFSUbMuCjRgW7+W0gBYh+fBuX2M2
-dsHANxPK3+Jt9DBcEFyG+3vcb3++1e2bZfwU0vOM3yHbZYhge/w8b8hr/l3HfrTH
-dVSJDQFKDRrx8lxlxxIWmN33iUJqhaSmPBkiu5m2ftIqx4Bnaw/O8MkbpV059PLw
-60jqwImw3w==
------END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/1C.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 28 (0x1c)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
+        Validity
+            Not Before: Jan  1 01:01:01 2035 GMT
+            Not After : Jan  2 01:01:01 2035 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA5_ta3/emailAddress=pubCA5_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c1:7d:e8:01:87:c0:29:55:4f:e7:82:49:3f:d3:
+                    58:23:af:60:58:22:68:d9:fe:67:b4:69:9e:48:ee:
+                    b9:05:dc:31:85:9d:5e:ba:2f:19:61:97:20:d5:99:
+                    d9:84:67:50:ce:bf:1b:ef:86:07:70:0e:fd:3f:22:
+                    a9:16:10:d6:2d:f6:30:23:36:54:28:16:33:d5:58:
+                    6c:15:fb:79:2e:af:07:43:77:11:bb:54:e9:e3:e5:
+                    5c:5b:5a:67:6f:bb:43:08:4e:c3:a8:77:06:25:92:
+                    10:cc:cb:1d:4a:7d:07:1e:83:1e:43:59:bc:b5:56:
+                    18:f6:2e:8a:4e:52:bf:fe:c1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                18:C6:4D:FD:87:0A:06:7E:55:86:3A:77:4F:0F:F7:33:67:02:F5:33
+            X509v3 Authority Key Identifier: 
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
+                serial:98:29:8D:38:A1:E7:D1:02
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+        09:28:d6:10:c6:de:9d:66:c1:a9:d4:83:53:d9:ba:27:a1:64:
+        ae:29:c2:07:42:33:b4:3c:1d:e1:8c:0a:c8:38:98:c8:89:d8:
+        98:26:41:75:56:b0:fa:30:d3:b8:ad:9f:47:7b:23:ec:da:99:
+        ff:8f:a7:18:56:43:13:bf:ee:19:0f:d8:70:c7:fe:4e:0b:1c:
+        54:e4:af:d5:01:72:a8:19:5e:21:ed:17:90:a1:fe:51:74:c6:
+        ba:29:89:e2:74:16:df:a8:89:7a:b3:ce:50:5f:9d:99:e7:76:
+        c0:98:38:03:c2:a5:bb:88:bd:57:bc:4d:59:ce:cd:e0:c6:ad:
+        3c:2c
+-----BEGIN CERTIFICATE-----
+MIIDJTCCAo6gAwIBAgIBHDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMzUw
+MTAxMDEwMTAxWhcNMzUwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0E1X3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0E1X3Rh
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwX3oAYfAKVVP54JJP9NYI69g
+WCJo2f5ntGmeSO65BdwxhZ1eui8ZYZcg1ZnZhGdQzr8b74YHcA79PyKpFhDWLfYw
+IzZUKBYz1VhsFft5Lq8HQ3cRu1Tp4+VcW1pnb7tDCE7DqHcGJZIQzMsdSn0HHoMe
+Q1m8tVYY9i6KTlK//sECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUGMZN/YcKBn5Vhjp3
+Tw/3M2cC9TMwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
+MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
+ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
+AQELBQADgYEACSjWEMbenWbBqdSDU9m6J6FkrinCB0IztDwd4YwKyDiYyInYmCZB
+dVaw+jDTuK2fR3sj7NqZ/4+nGFZDE7/uGQ/YcMf+TgscVOSv1QFyqBleIe0XkKH+
+UXTGuimJ4nQW36iJerPOUF+dmed2wJg4A8Klu4i9V7xNWc7N4MatPCw=
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/1E.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,65 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 30 (0x1e)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
+        Validity
+            Not Before: Jan 28 02:54:22 2011 GMT
+            Not After : Oct 24 02:54:22 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:ae:1e:e8:c6:51:70:cc:7b:06:87:47:a1:f0:5a:
+                    fa:f3:cf:c4:fd:eb:ac:32:d9:ab:dd:36:15:09:71:
+                    73:12:a3:6e:16:4a:af:83:33:d9:e0:1c:e8:63:ac:
+                    c7:8d:79:47:5a:cf:63:67:e1:0d:74:bc:09:16:8b:
+                    e1:27:24:78:6a:41:a5:c9:2f:4d:49:ef:a2:61:81:
+                    45:98:21:b3:2a:d3:89:94:06:18:87:81:90:63:fc:
+                    40:17:8d:89:35:6e:c5:68:d5:6d:89:d3:18:e2:07:
+                    e1:9f:f7:5f:78:24:83:11:c6:e5:0b:77:c3:3f:c9:
+                    50:26:39:9c:8b:0d:18:fe:3b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                D3:DE:A8:63:F4:5C:5D:8E:DD:53:9F:D7:9E:90:14:71:D1:21:88:4B
+            X509v3 Authority Key Identifier: 
+                keyid:B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
+                serial:FC:C0:EE:93:13:43:17:2D
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+        87:6d:c1:4d:b1:ea:af:f8:20:d9:dd:d8:cd:e1:60:62:41:a5:
+        5a:58:1e:cc:cb:fa:23:a9:82:fe:2c:54:53:86:f3:52:2f:ab:
+        8d:1b:68:9d:3b:83:e3:fd:37:2f:b5:d0:24:cf:78:98:ff:0a:
+        63:47:0b:c9:52:96:4f:5d:94:e1:28:fa:c4:eb:ea:17:42:6b:
+        a2:30:37:bb:54:ac:47:45:55:2a:30:75:54:c9:7f:01:b9:9a:
+        55:3b:4d:bd:e5:29:02:a9:3c:f0:b4:b8:c4:c0:90:34:cd:94:
+        30:97:a8:16:2c:25:c8:da:cc:bd:0e:ea:5b:bf:dd:7b:7f:aa:
+        f5:05
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAp6gAwIBAgIBHjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGE0MRIwEAYJKoZIhvcNAQkBFgN0YTQwHhcNMTEw
+MTI4MDI1NDIyWhcNMTMxMDI0MDI1NDIyWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
+NDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEArh7oxlFwzHsGh0eh8Fr688/E
+/eusMtmr3TYVCXFzEqNuFkqvgzPZ4BzoY6zHjXlHWs9jZ+ENdLwJFovhJyR4akGl
+yS9NSe+iYYFFmCGzKtOJlAYYh4GQY/xAF42JNW7FaNVtidMY4gfhn/dfeCSDEcbl
+C3fDP8lQJjmciw0Y/jsCAwEAAaOB4DCB3TAdBgNVHQ4EFgQU096oY/RcXY7dU5/X
+npAUcdEhiEswgZoGA1UdIwSBkjCBj4AUuahSX5EbKiepCpRUBlIvcoaFnnWhbKRq
+MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
+ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG
+9w0BCQEWA3RhNIIJAPzA7pMTQxctMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIdtwU2x6q/4INnd2M3hYGJBpVpYHszL
++iOpgv4sVFOG81Ivq40baJ07g+P9Ny+10CTPeJj/CmNHC8lSlk9dlOEo+sTr6hdC
+a6IwN7tUrEdFVSowdVTJfwG5mlU7Tb3lKQKpPPC0uMTAkDTNlDCXqBYsJcjazL0O
+6lu/3Xt/qvUF
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/22.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,65 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 34 (0x22)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
+        Validity
+            Not Before: Jan 28 02:54:24 2011 GMT
+            Not After : Oct 24 02:54:24 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta4/emailAddress=pubCA2_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b4:ad:43:56:c0:47:59:45:17:9b:25:94:a6:3f:
+                    07:fa:0d:8c:17:bd:1d:ea:b0:14:73:4f:ab:91:ad:
+                    e5:72:15:a8:c3:5d:d2:37:d3:1c:9f:0d:b5:b1:5d:
+                    dc:e9:ca:dd:ba:58:de:d7:10:ca:ce:f7:76:4a:da:
+                    62:87:04:00:34:ee:d2:2a:32:fa:57:0e:a3:a8:0c:
+                    f8:98:65:72:9b:65:2d:90:50:be:c0:a2:2e:33:13:
+                    55:2f:17:8f:88:83:2a:e9:e0:a1:e1:6d:43:d1:2f:
+                    a7:6b:4c:a9:67:8f:3d:9d:3c:46:91:c8:fc:b8:38:
+                    65:16:c5:60:b8:8a:7e:36:e3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                7E:D7:20:26:1C:A5:29:A9:33:67:3B:8C:F6:91:31:8E:14:D9:C6:D6
+            X509v3 Authority Key Identifier: 
+                keyid:B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
+                serial:FC:C0:EE:93:13:43:17:2D
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign
+    Signature Algorithm: sha256WithRSAEncryption
+        8a:49:79:6d:e2:18:16:a9:63:8c:a6:4c:78:02:27:7e:2b:99:
+        1f:a0:bd:23:93:6e:32:70:f9:4c:fd:c0:9c:78:11:1c:0e:ee:
+        3c:35:c6:12:70:c3:4b:4a:25:e1:20:75:9d:a0:37:b2:db:7a:
+        62:b2:a2:a6:37:5b:e5:fd:89:ec:bd:23:03:95:38:05:da:92:
+        5e:b4:32:b2:a1:0e:c2:cb:8e:62:01:f7:b5:87:c5:39:4a:40:
+        11:e4:fe:52:c5:ac:b7:c4:ca:4d:7b:c4:3c:79:f6:6f:a0:bc:
+        04:e5:dd:38:a0:e8:86:d5:14:01:bf:f5:01:bb:cc:7a:19:39:
+        a8:ff
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAp6gAwIBAgIBIjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGE0MRIwEAYJKoZIhvcNAQkBFgN0YTQwHhcNMTEw
+MTI4MDI1NDI0WhcNMTMxMDI0MDI1NDI0WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0EyX3RhNDEZMBcGCSqGSIb3DQEJARYKcHViQ0EyX3Rh
+NDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtK1DVsBHWUUXmyWUpj8H+g2M
+F70d6rAUc0+rka3lchWow13SN9Mcnw21sV3c6crdulje1xDKzvd2StpihwQANO7S
+KjL6Vw6jqAz4mGVym2UtkFC+wKIuMxNVLxePiIMq6eCh4W1D0S+na0ypZ489nTxG
+kcj8uDhlFsVguIp+NuMCAwEAAaOB4DCB3TAdBgNVHQ4EFgQUftcgJhylKakzZzuM
+9pExjhTZxtYwgZoGA1UdIwSBkjCBj4AUuahSX5EbKiepCpRUBlIvcoaFnnWhbKRq
+MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
+ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG
+9w0BCQEWA3RhNIIJAPzA7pMTQxctMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgIEMA0GCSqGSIb3DQEBCwUAA4GBAIpJeW3iGBapY4ymTHgCJ34rmR+gvSOT
+bjJw+Uz9wJx4ERwO7jw1xhJww0tKJeEgdZ2gN7LbemKyoqY3W+X9iey9IwOVOAXa
+kl60MrKhDsLLjmIB97WHxTlKQBHk/lLFrLfEyk17xDx59m+gvATl3Tig6IbVFAG/
+9QG7zHoZOaj/
+-----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/24.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,69 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 36 (0x24)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta5/emailAddress=ta5
+        Validity
+            Not Before: Jan 28 02:54:25 2011 GMT
+            Not After : Oct 24 02:54:25 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta5/emailAddress=pubCA1_ta5
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:d4:c6:69:11:45:2f:32:b0:20:8d:2d:0f:5c:5e:
+                    36:10:ef:63:37:6a:03:b4:62:86:68:8f:fb:72:87:
+                    91:15:5f:8e:b5:25:0c:d1:b3:c0:57:28:b5:56:d8:
+                    8b:bc:c0:f5:ed:8a:d0:fb:56:45:91:ca:ae:a3:2f:
+                    f1:36:bf:54:91:c6:93:04:68:17:27:e5:96:fd:92:
+                    af:8f:5b:62:65:f7:2d:6d:5a:dc:2f:05:44:b7:7d:
+                    de:49:26:0b:ec:09:71:d0:bd:39:97:5b:0a:c8:80:
+                    5b:6b:aa:19:8c:b2:df:73:ea:ce:a3:48:b1:b2:ba:
+                    3f:58:3f:75:86:b0:9c:4c:5b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                52:C8:5D:28:0A:C3:1A:23:E7:52:17:1A:67:EB:EF:0F:BC:9F:0F:A7
+            X509v3 Authority Key Identifier: 
+                keyid:62:0A:5F:1E:BA:AD:0B:1E:13:7A:CA:B4:5C:12:64:1F:BF:44:C6:B0
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta5/emailAddress=ta5
+                serial:E0:A1:00:60:AE:57:96:B2
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 CRL Distribution Points: 
+                URI:http://localhost:12001/file/0/ta5_crl.pem
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+        97:a5:5a:64:29:bd:24:f5:b1:27:11:83:2f:e7:a9:a5:f3:0b:
+        2b:b3:43:1f:74:c8:54:fa:56:5b:4f:7b:a2:3b:bc:db:4d:a6:
+        c7:07:fb:52:2d:91:37:6a:fb:f1:c7:2a:54:3d:31:78:85:a5:
+        f3:10:bf:05:2e:48:bb:bd:ed:d7:1d:7c:31:b5:4c:41:79:97:
+        d6:2e:02:1b:84:77:24:47:57:00:56:a7:89:1c:f5:6d:d3:d8:
+        da:69:a3:b9:2b:d2:73:c0:d4:a8:c1:86:4f:ba:04:2b:ea:2f:
+        0b:a4:1d:83:71:02:b5:47:87:13:ec:66:bb:87:6a:af:c2:1d:
+        07:5d
+-----BEGIN CERTIFICATE-----
+MIIDczCCAtygAwIBAgIBJDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGE1MRIwEAYJKoZIhvcNAQkBFgN0YTUwHhcNMTEw
+MTI4MDI1NDI1WhcNMTMxMDI0MDI1NDI1WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0ExX3RhNTEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
+NTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1MZpEUUvMrAgjS0PXF42EO9j
+N2oDtGKGaI/7coeRFV+OtSUM0bPAVyi1VtiLvMD17YrQ+1ZFkcquoy/xNr9UkcaT
+BGgXJ+WW/ZKvj1tiZfctbVrcLwVEt33eSSYL7Alx0L05l1sKyIBba6oZjLLfc+rO
+o0ixsro/WD91hrCcTFsCAwEAAaOCAR0wggEZMB0GA1UdDgQWBBRSyF0oCsMaI+dS
+Fxpn6+8PvJ8PpzCBmgYDVR0jBIGSMIGPgBRiCl8euq0LHhN6yrRcEmQfv0TGsKFs
+pGowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzARBgNVBAcT
+Ck1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDDAKBgNVBAMTA3RhNTESMBAGCSqG
+SIb3DQEJARYDdGE1ggkA4KEAYK5XlrIwDwYDVR0TAQH/BAUwAwEB/zA6BgNVHR8E
+MzAxMC+gLaArhilodHRwOi8vbG9jYWxob3N0OjEyMDAxL2ZpbGUvMC90YTVfY3Js
+LnBlbTAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAl6VaZCm9JPWx
+JxGDL+eppfMLK7NDH3TIVPpWW097oju8202mxwf7Ui2RN2r78ccqVD0xeIWl8xC/
+BS5Iu73t1x18MbVMQXmX1i4CG4R3JEdXAFaniRz1bdPY2mmjuSvSc8DUqMGGT7oE
+K+ovC6Qdg3ECtUeHE+xmu4dqr8IdB10=
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=i2_ta1/emailAddress=i2_ta1
         Validity
-            Not Before: Aug  4 20:59:23 2010 GMT
-            Not After : Apr 30 20:59:23 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta1/emailAddress=pubCA1_ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:aa:b0:34:d1:f2:16:6f:f7:d5:33:8d:45:66:2c:
-                    be:01:ec:68:c9:31:ca:ee:7f:93:fc:d6:17:13:e0:
-                    ba:fb:29:e1:70:3b:12:15:3a:b2:42:96:8b:25:d1:
-                    f3:59:64:58:fa:ad:8d:26:3b:cf:4b:88:e1:32:6f:
-                    2e:e3:69:d3:4a:4d:7e:c8:f9:5c:7a:40:a9:14:ba:
-                    0e:3e:a7:f1:d9:7f:a7:3f:de:2d:96:83:52:d7:1f:
-                    eb:ff:e9:08:66:35:d8:38:8a:15:b7:0e:5e:a5:e2:
-                    4d:e3:74:b6:1e:14:05:78:67:ed:fb:82:cc:55:c5:
-                    03:df:64:8f:09:d0:3b:c5:d3
+                    00:df:99:e1:31:21:52:4c:52:21:74:ae:ca:4d:e9:
+                    75:6d:3a:23:75:8e:9c:52:a3:3e:53:cf:fb:cd:cc:
+                    47:74:d2:8e:5d:65:57:a1:ad:1b:cf:58:23:9e:53:
+                    9d:3c:1a:46:60:98:d9:5e:3c:e5:d0:c4:cb:0c:28:
+                    59:96:5e:26:c8:1d:29:e9:01:a5:5a:3b:df:9e:1a:
+                    85:f4:9d:53:0e:19:81:20:d8:bc:3d:2a:89:e7:8c:
+                    fe:75:61:45:a5:f7:6a:7f:ad:94:a2:95:4b:58:35:
+                    2a:6f:e9:54:4b:2c:bf:07:0a:39:03:7e:c0:96:1b:
+                    9e:8f:39:fa:49:3e:d0:4f:6b
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                E8:81:62:06:D5:A6:C6:2E:6C:2A:4F:A3:21:42:59:CD:19:5B:32:ED
+                F1:31:DD:AE:13:EF:6C:62:A3:83:98:4D:1F:0D:25:1A:21:28:1E:5D
             X509v3 Authority Key Identifier: 
-                keyid:E3:6D:6B:62:16:42:41:2B:9C:3B:68:01:F3:EF:16:3C:31:83:05:41
+                keyid:4A:49:37:7B:87:42:F2:B2:3F:07:11:1E:FC:AD:31:B2:C9:DA:CD:25
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=i1_ta1/emailAddress=i1_ta1
                 serial:02
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        72:ed:f0:65:97:65:56:53:3c:c8:78:ae:a1:22:70:c3:a0:1d:
-        db:42:3b:75:43:c9:b1:98:7d:7c:c4:c0:41:07:b4:18:72:26:
-        34:98:35:c1:20:17:1c:dc:53:59:a6:d9:42:01:f3:0d:9b:16:
-        f9:15:73:3f:1f:49:71:06:f0:0c:b0:49:d2:2c:89:f7:42:7f:
-        b5:37:55:fb:49:2e:2b:8e:c1:70:e3:84:96:13:ab:63:f9:70:
-        11:89:86:b7:e9:db:1e:56:dc:9a:78:3b:ad:47:30:5f:98:28:
-        8c:ea:f2:8f:af:40:b8:93:73:72:b0:be:e0:52:72:69:e8:ee:
-        52:4d
+        98:18:b3:7c:e7:02:ff:ac:b5:bd:af:2d:7e:02:5a:f2:db:fd:
+        1a:c8:31:20:44:2a:b4:78:df:87:f4:f5:5d:f0:bb:ee:97:d0:
+        45:db:10:2b:e3:1c:96:45:7b:d1:7c:d7:95:d8:f7:13:d1:2e:
+        da:59:09:68:6c:1f:f1:b7:b6:c4:1b:3c:89:38:9e:ff:5a:74:
+        53:18:56:3b:9e:ba:c2:a6:e3:f0:94:85:6a:89:bb:7c:f3:a8:
+        8e:33:c5:54:d1:e1:4c:31:b6:c8:4d:e0:62:36:d6:83:a3:08:
+        c4:e7:c4:5c:20:61:b4:8b:5c:05:2c:8c:28:b1:83:2f:68:e8:
+        16:92
 -----BEGIN CERTIFICATE-----
-MIIDKTCCApKgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
+MIIDOTCCAqKgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBuMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEPMA0GA1UEAxQGaTJfdGExMRUwEwYJKoZIhvcNAQkBFgZpMl90YTEw
-HhcNMTAwODA0MjA1OTIzWhcNMTMwNDMwMjA1OTIzWjB2MQswCQYDVQQGEwJVUzET
+HhcNMTEwMTI4MDI1NDEwWhcNMTMxMDI0MDI1NDEwWjB2MQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTETMBEGA1UEAxQKcHViQ0ExX3RhMTEZMBcGCSqGSIb3DQEJARYKcHVi
-Q0ExX3RhMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqrA00fIWb/fVM41F
-Ziy+AexoyTHK7n+T/NYXE+C6+ynhcDsSFTqyQpaLJdHzWWRY+q2NJjvPS4jhMm8u
-42nTSk1+yPlcekCpFLoOPqfx2X+nP94tloNS1x/r/+kIZjXYOIoVtw5epeJN43S2
-HhQFeGft+4LMVcUD32SPCdA7xdMCAwEAAaOBzjCByzAdBgNVHQ4EFgQU6IFiBtWm
-xi5sKk+jIUJZzRlbMu0wgZgGA1UdIwSBkDCBjYAU421rYhZCQSucO2gB8+8WPDGD
-BUGhcqRwMG4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYD
+Q0ExX3RhMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA35nhMSFSTFIhdK7K
+Tel1bTojdY6cUqM+U8/7zcxHdNKOXWVXoa0bz1gjnlOdPBpGYJjZXjzl0MTLDChZ
+ll4myB0p6QGlWjvfnhqF9J1TDhmBINi8PSqJ54z+dWFFpfdqf62UopVLWDUqb+lU
+Syy/Bwo5A37Alhuejzn6ST7QT2sCAwEAAaOB3jCB2zAdBgNVHQ4EFgQU8THdrhPv
+bGKjg5hNHw0lGiEoHl0wgZgGA1UdIwSBkDCBjYAUSkk3e4dC8rI/BxEe/K0xssna
+zSWhcqRwMG4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYD
 VQQHEwpNZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQ8wDQYDVQQDFAZpMV90YTEx
-FTATBgkqhkiG9w0BCQEWBmkxX3RhMYIBAjAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
-SIb3DQEBCwUAA4GBAHLt8GWXZVZTPMh4rqEicMOgHdtCO3VDybGYfXzEwEEHtBhy
-JjSYNcEgFxzcU1mm2UIB8w2bFvkVcz8fSXEG8AywSdIsifdCf7U3VftJLiuOwXDj
-hJYTq2P5cBGJhrfp2x5W3Jp4O61HMF+YKIzq8o+vQLiTc3KwvuBScmno7lJN
+FTATBgkqhkiG9w0BCQEWBmkxX3RhMYIBAjAPBgNVHRMBAf8EBTADAQH/MA4GA1Ud
+DwEB/wQEAwIBBjANBgkqhkiG9w0BAQsFAAOBgQCYGLN85wL/rLW9ry1+Alry2/0a
+yDEgRCq0eN+H9PVd8Lvul9BF2xAr4xyWRXvRfNeV2PcT0S7aWQlobB/xt7bEGzyJ
+OJ7/WnRTGFY7nrrCpuPwlIVqibt886iOM8VU0eFMMbbITeBiNtaDowjE58RcIGG0
+i1wFLIwosYMvaOgWkg==
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -5,58 +5,61 @@
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta3/emailAddress=pubCA1_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:bd:ef:e1:5e:a1:32:ff:ee:9b:64:1a:a3:f0:e2:
-                    63:64:ab:7d:60:5e:32:60:36:f5:67:54:d0:e0:13:
-                    6e:ef:88:c1:ff:0e:64:d2:f4:cc:07:fd:18:03:90:
-                    fb:73:b7:91:c9:9e:97:b2:b0:0a:ae:9f:88:dc:29:
-                    fd:2c:19:09:43:ef:68:7c:ab:de:91:de:51:cb:e2:
-                    35:fc:96:fe:13:e9:3c:ea:97:3c:2a:ef:92:9a:31:
-                    77:e4:a2:24:40:01:6e:a0:59:ef:7e:71:d9:be:5a:
-                    3f:ed:7e:b6:d5:7b:38:6d:4c:16:f8:fd:ec:fb:6f:
-                    8c:41:fb:fd:dc:0c:54:1c:db
+                    00:dd:e0:f7:ca:f9:42:6a:e9:28:bf:8c:08:48:4c:
+                    17:fc:35:c5:2c:0c:b4:07:7c:c1:c4:05:bb:88:15:
+                    2f:25:23:db:41:b0:24:8e:54:3b:44:02:4b:8f:60:
+                    3b:13:ef:f9:7d:8d:5d:dc:34:b3:13:b9:28:5d:3c:
+                    4b:c1:76:6c:ae:ff:a3:7a:44:71:76:f9:0b:1a:cc:
+                    df:5a:37:9c:b3:12:eb:38:99:3b:85:f7:eb:13:93:
+                    34:02:4b:54:7c:52:fd:ad:58:46:70:af:7b:2d:7f:
+                    56:5a:f3:95:66:5a:52:2a:da:c3:b2:98:7b:2f:cd:
+                    44:2f:2d:24:c9:6a:29:90:fd
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                47:D6:CB:F2:38:3E:A8:40:85:4A:BE:EF:F8:85:B3:49:FF:D0:8F:16
+                C1:F8:27:0B:0D:24:82:11:16:5F:44:79:21:5A:E7:BF:F8:2E:7F:61
             X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
+                serial:98:29:8D:38:A1:E7:D1:02
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        6a:25:8d:33:01:c1:a0:fe:99:5f:f0:b4:8a:39:86:55:f5:6c:
-        59:2a:84:a5:01:10:dd:1a:b6:a2:52:17:62:e1:e5:d5:8a:e9:
-        09:bd:04:95:b1:a4:b3:ec:9b:73:f3:54:12:26:97:a5:1e:52:
-        9e:bf:93:c7:4d:dd:a3:c4:ec:0b:46:3e:e4:b7:c3:47:17:68:
-        15:df:a1:1a:67:c0:8b:f6:a8:ea:ab:81:6a:fc:a3:4c:5b:0e:
-        ca:cc:b7:bf:e5:35:73:e9:95:d0:ad:8c:fc:2a:7d:2c:ee:6b:
-        09:53:2f:f3:9b:57:fa:32:bb:02:f9:10:fa:30:a2:e3:55:0c:
-        4a:73
+        17:cc:85:98:2b:c5:c8:ce:30:6a:c8:99:c8:d5:41:68:37:12:
+        e3:63:2d:47:33:b0:46:78:f7:c4:3a:cf:84:c9:5b:03:61:19:
+        40:69:7e:63:00:16:9d:15:73:39:1e:c3:e1:f6:fe:a5:88:5b:
+        86:c1:3e:9b:c4:ce:34:6b:51:a1:2b:47:6c:ae:17:c3:b4:c5:
+        b4:be:14:47:0a:a3:f3:c5:fb:bb:85:4e:31:74:28:cf:fa:9d:
+        71:e0:93:68:c9:e4:83:33:1d:80:76:2d:cf:38:5b:4d:3e:e5:
+        16:0a:13:d4:ce:31:d9:b3:7b:6d:10:7f:6a:60:39:8a:ff:f2:
+        22:a5
 -----BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBDDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDNTCCAp6gAwIBAgIBDDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTAw
-ODA0MjA1OTI1WhcNMTMwNDMwMjA1OTI1WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTEw
+MTI4MDI1NDEzWhcNMTMxMDI0MDI1NDEzWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTETMBEGA1UEAxQKcHViQ0ExX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAve/hXqEy/+6bZBqj8OJjZKt9
-YF4yYDb1Z1TQ4BNu74jB/w5k0vTMB/0YA5D7c7eRyZ6XsrAKrp+I3Cn9LBkJQ+9o
-fKvekd5Ry+I1/Jb+E+k86pc8Ku+SmjF35KIkQAFuoFnvfnHZvlo/7X621Xs4bUwW
-+P3s+2+MQfv93AxUHNsCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUR9bL8jg+qECFSr7v
-+IWzSf/QjxYwgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRq
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3eD3yvlCaukov4wISEwX/DXF
+LAy0B3zBxAW7iBUvJSPbQbAkjlQ7RAJLj2A7E+/5fY1d3DSzE7koXTxLwXZsrv+j
+ekRxdvkLGszfWjecsxLrOJk7hffrE5M0AktUfFL9rVhGcK97LX9WWvOVZlpSKtrD
+sph7L81ELy0kyWopkP0CAwEAAaOB4DCB3TAdBgNVHQ4EFgQUwfgnCw0kghEWX0R5
+IVrnv/guf2EwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
 MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
 ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
-9w0BCQEWA3RhM4IJAOH4Ui+s9ADuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAaiWNMwHBoP6ZX/C0ijmGVfVsWSqEpQEQ3Rq2olIXYuHl1YrpCb0E
-lbGks+ybc/NUEiaXpR5Snr+Tx03do8TsC0Y+5LfDRxdoFd+hGmfAi/ao6quBavyj
-TFsOysy3v+U1c+mV0K2M/Cp9LO5rCVMv85tX+jK7AvkQ+jCi41UMSnM=
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBABfMhZgrxcjOMGrImcjVQWg3EuNjLUcz
+sEZ498Q6z4TJWwNhGUBpfmMAFp0Vczkew+H2/qWIW4bBPpvEzjRrUaErR2yuF8O0
+xbS+FEcKo/PF+7uFTjF0KM/6nXHgk2jJ5IMzHYB2Lc84W00+5RYKE9TOMdmze20Q
+f2pgOYr/8iKl
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta4_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,62 +1,65 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 23 (0x17)
+        Serial Number: 30 (0x1e)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
         Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
+            Not Before: Jan 28 02:54:22 2011 GMT
+            Not After : Oct 24 02:54:22 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta4/emailAddress=pubCA1_ta4
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b4:f4:b1:9f:49:97:92:18:a9:fa:94:37:f9:45:
-                    5f:31:c4:2d:f6:19:fe:9a:ac:4d:bb:da:7d:99:0c:
-                    e1:f0:b2:0f:9b:b8:c5:ba:58:f8:3e:52:7d:83:17:
-                    c2:7a:f9:ae:f6:26:75:9f:17:9a:8a:0b:a0:2c:38:
-                    d4:fc:ac:02:7f:1b:2e:c9:92:da:79:21:10:5b:7c:
-                    56:3c:de:7e:64:52:73:42:5c:1b:44:94:8b:16:de:
-                    ab:eb:b3:6d:8a:41:11:c7:7e:06:93:fa:a6:9b:00:
-                    1d:ec:d4:cd:07:69:46:4b:7e:60:7f:4b:93:f6:8d:
-                    c5:07:fe:0b:44:a8:3c:db:a5
+                    00:ae:1e:e8:c6:51:70:cc:7b:06:87:47:a1:f0:5a:
+                    fa:f3:cf:c4:fd:eb:ac:32:d9:ab:dd:36:15:09:71:
+                    73:12:a3:6e:16:4a:af:83:33:d9:e0:1c:e8:63:ac:
+                    c7:8d:79:47:5a:cf:63:67:e1:0d:74:bc:09:16:8b:
+                    e1:27:24:78:6a:41:a5:c9:2f:4d:49:ef:a2:61:81:
+                    45:98:21:b3:2a:d3:89:94:06:18:87:81:90:63:fc:
+                    40:17:8d:89:35:6e:c5:68:d5:6d:89:d3:18:e2:07:
+                    e1:9f:f7:5f:78:24:83:11:c6:e5:0b:77:c3:3f:c9:
+                    50:26:39:9c:8b:0d:18:fe:3b
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                EE:8D:78:53:11:FE:07:CB:C8:55:4B:EF:A6:2F:E1:83:72:BB:BA:21
+                D3:DE:A8:63:F4:5C:5D:8E:DD:53:9F:D7:9E:90:14:71:D1:21:88:4B
             X509v3 Authority Key Identifier: 
-                keyid:FE:14:53:EF:9C:0B:AB:ED:96:22:70:11:C2:E6:7D:2E:40:B7:7F:B5
+                keyid:B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:C0:C8:77:B4:4C:49:4F:AB
+                serial:FC:C0:EE:93:13:43:17:2D
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        5c:2c:f2:7c:8d:72:aa:d1:e2:20:a2:c6:76:84:44:b9:6e:54:
-        2c:39:95:99:a9:50:bb:1c:b9:9e:8e:04:92:b5:b6:95:17:92:
-        a8:0b:09:3e:f5:5a:10:99:5a:27:2f:0f:03:4b:ea:bd:2b:bb:
-        b5:1e:51:5b:2f:7f:67:15:88:4a:e0:38:53:50:91:8c:4f:fb:
-        38:bd:52:43:37:19:3f:5b:c0:db:ed:68:90:a7:6e:28:82:2b:
-        6a:a3:08:01:23:4b:1b:3e:b0:4e:02:a6:9b:6f:f4:57:c9:41:
-        7d:66:d9:00:c1:8d:1c:73:96:01:61:b6:92:2b:ac:e8:42:8f:
-        79:29
+        87:6d:c1:4d:b1:ea:af:f8:20:d9:dd:d8:cd:e1:60:62:41:a5:
+        5a:58:1e:cc:cb:fa:23:a9:82:fe:2c:54:53:86:f3:52:2f:ab:
+        8d:1b:68:9d:3b:83:e3:fd:37:2f:b5:d0:24:cf:78:98:ff:0a:
+        63:47:0b:c9:52:96:4f:5d:94:e1:28:fa:c4:eb:ea:17:42:6b:
+        a2:30:37:bb:54:ac:47:45:55:2a:30:75:54:c9:7f:01:b9:9a:
+        55:3b:4d:bd:e5:29:02:a9:3c:f0:b4:b8:c4:c0:90:34:cd:94:
+        30:97:a8:16:2c:25:c8:da:cc:bd:0e:ea:5b:bf:dd:7b:7f:aa:
+        f5:05
 -----BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBFzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDNTCCAp6gAwIBAgIBHjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGE0MRIwEAYJKoZIhvcNAQkBFgN0YTQwHhcNMTAw
-ODA0MjA1OTI4WhcNMTMwNDMwMjA1OTI4WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGE0MRIwEAYJKoZIhvcNAQkBFgN0YTQwHhcNMTEw
+MTI4MDI1NDIyWhcNMTMxMDI0MDI1NDIyWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTETMBEGA1UEAxQKcHViQ0ExX3RhNDEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
-NDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtPSxn0mXkhip+pQ3+UVfMcQt
-9hn+mqxNu9p9mQzh8LIPm7jFulj4PlJ9gxfCevmu9iZ1nxeaigugLDjU/KwCfxsu
-yZLaeSEQW3xWPN5+ZFJzQlwbRJSLFt6r67NtikERx34Gk/qmmwAd7NTNB2lGS35g
-f0uT9o3FB/4LRKg826UCAwEAAaOB0DCBzTAdBgNVHQ4EFgQU7o14UxH+B8vIVUvv
-pi/hg3K7uiEwgZoGA1UdIwSBkjCBj4AU/hRT75wLq+2WInARwuZ9LkC3f7WhbKRq
+NDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEArh7oxlFwzHsGh0eh8Fr688/E
+/eusMtmr3TYVCXFzEqNuFkqvgzPZ4BzoY6zHjXlHWs9jZ+ENdLwJFovhJyR4akGl
+yS9NSe+iYYFFmCGzKtOJlAYYh4GQY/xAF42JNW7FaNVtidMY4gfhn/dfeCSDEcbl
+C3fDP8lQJjmciw0Y/jsCAwEAAaOB4DCB3TAdBgNVHQ4EFgQU096oY/RcXY7dU5/X
+npAUcdEhiEswgZoGA1UdIwSBkjCBj4AUuahSX5EbKiepCpRUBlIvcoaFnnWhbKRq
 MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
 ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG
-9w0BCQEWA3RhNIIJAMDId7RMSU+rMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAXCzyfI1yqtHiIKLGdoREuW5ULDmVmalQuxy5no4EkrW2lReSqAsJ
-PvVaEJlaJy8PA0vqvSu7tR5RWy9/ZxWISuA4U1CRjE/7OL1SQzcZP1vA2+1okKdu
-KIIraqMIASNLGz6wTgKmm2/0V8lBfWbZAMGNHHOWAWG2kius6EKPeSk=
+9w0BCQEWA3RhNIIJAPzA7pMTQxctMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAIdtwU2x6q/4INnd2M3hYGJBpVpYHszL
++iOpgv4sVFOG81Ivq40baJ07g+P9Ny+10CTPeJj/CmNHC8lSlk9dlOEo+sTr6hdC
+a6IwN7tUrEdFVSowdVTJfwG5mlU7Tb3lKQKpPPC0uMTAkDTNlDCXqBYsJcjazL0O
+6lu/3Xt/qvUF
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta5_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA1_ta5_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,67 +1,69 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 27 (0x1b)
+        Serial Number: 36 (0x24)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta5/emailAddress=ta5
         Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
+            Not Before: Jan 28 02:54:25 2011 GMT
+            Not After : Oct 24 02:54:25 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA1_ta5/emailAddress=pubCA1_ta5
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:f1:eb:41:9f:0b:f5:8c:66:1f:8c:5d:e0:9a:a6:
-                    d3:3c:a6:af:66:36:e2:5c:8b:c4:a7:ff:fb:6f:f0:
-                    65:33:b2:a2:f2:8a:1c:94:ad:de:96:d7:7a:75:78:
-                    e1:5f:a8:c9:51:08:ff:38:df:2e:cf:37:b2:a8:e4:
-                    82:60:55:d5:40:bc:a0:b3:94:a4:59:51:ad:d8:26:
-                    64:ce:d5:54:10:5a:78:52:f1:f8:bc:d6:dc:a7:40:
-                    57:82:4f:2f:09:16:de:5b:88:42:aa:67:3e:1f:8b:
-                    b7:6e:a9:1e:6a:12:a8:35:9f:28:85:23:29:3a:20:
-                    0e:cd:89:3e:73:40:e8:d6:1b
+                    00:d4:c6:69:11:45:2f:32:b0:20:8d:2d:0f:5c:5e:
+                    36:10:ef:63:37:6a:03:b4:62:86:68:8f:fb:72:87:
+                    91:15:5f:8e:b5:25:0c:d1:b3:c0:57:28:b5:56:d8:
+                    8b:bc:c0:f5:ed:8a:d0:fb:56:45:91:ca:ae:a3:2f:
+                    f1:36:bf:54:91:c6:93:04:68:17:27:e5:96:fd:92:
+                    af:8f:5b:62:65:f7:2d:6d:5a:dc:2f:05:44:b7:7d:
+                    de:49:26:0b:ec:09:71:d0:bd:39:97:5b:0a:c8:80:
+                    5b:6b:aa:19:8c:b2:df:73:ea:ce:a3:48:b1:b2:ba:
+                    3f:58:3f:75:86:b0:9c:4c:5b
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                B7:AD:D9:89:4D:93:68:D0:D6:CB:4B:DB:6D:D6:CB:03:74:85:4B:AC
+                52:C8:5D:28:0A:C3:1A:23:E7:52:17:1A:67:EB:EF:0F:BC:9F:0F:A7
             X509v3 Authority Key Identifier: 
-                keyid:AA:44:3A:A2:05:A2:04:EB:62:E0:E5:F5:2C:44:CA:3B:CF:4D:B2:74
+                keyid:62:0A:5F:1E:BA:AD:0B:1E:13:7A:CA:B4:5C:12:64:1F:BF:44:C6:B0
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta5/emailAddress=ta5
-                serial:CB:2A:36:97:17:4F:60:24
+                serial:E0:A1:00:60:AE:57:96:B2
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
             X509v3 CRL Distribution Points: 
                 URI:http://localhost:12001/file/0/ta5_crl.pem
 
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        93:e0:33:e4:90:54:94:6c:cb:82:8d:18:16:ef:e5:b4:80:16:
-        21:f9:f0:6e:5f:63:36:76:c1:c0:37:13:ca:df:e2:6d:f4:30:
-        5c:10:5c:86:fb:7b:dc:6f:7f:be:d5:ed:9b:65:fc:14:d2:f3:
-        8c:df:21:db:65:88:60:7b:fc:3c:6f:c8:6b:fe:5d:c7:7e:b4:
-        c7:75:54:89:0d:01:4a:0d:1a:f1:f2:5c:65:c7:12:16:98:dd:
-        f7:89:42:6a:85:a4:a6:3c:19:22:bb:99:b6:7e:d2:2a:c7:80:
-        67:6b:0f:ce:f0:c9:1b:a5:5d:39:f4:f2:f0:eb:48:ea:c0:89:
-        b0:df
+        97:a5:5a:64:29:bd:24:f5:b1:27:11:83:2f:e7:a9:a5:f3:0b:
+        2b:b3:43:1f:74:c8:54:fa:56:5b:4f:7b:a2:3b:bc:db:4d:a6:
+        c7:07:fb:52:2d:91:37:6a:fb:f1:c7:2a:54:3d:31:78:85:a5:
+        f3:10:bf:05:2e:48:bb:bd:ed:d7:1d:7c:31:b5:4c:41:79:97:
+        d6:2e:02:1b:84:77:24:47:57:00:56:a7:89:1c:f5:6d:d3:d8:
+        da:69:a3:b9:2b:d2:73:c0:d4:a8:c1:86:4f:ba:04:2b:ea:2f:
+        0b:a4:1d:83:71:02:b5:47:87:13:ec:66:bb:87:6a:af:c2:1d:
+        07:5d
 -----BEGIN CERTIFICATE-----
-MIIDYzCCAsygAwIBAgIBGzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDczCCAtygAwIBAgIBJDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGE1MRIwEAYJKoZIhvcNAQkBFgN0YTUwHhcNMTAw
-ODA0MjA1OTI5WhcNMTMwNDMwMjA1OTI5WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGE1MRIwEAYJKoZIhvcNAQkBFgN0YTUwHhcNMTEw
+MTI4MDI1NDI1WhcNMTMxMDI0MDI1NDI1WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTETMBEGA1UEAxQKcHViQ0ExX3RhNTEZMBcGCSqGSIb3DQEJARYKcHViQ0ExX3Rh
-NTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA8etBnwv1jGYfjF3gmqbTPKav
-ZjbiXIvEp//7b/BlM7Ki8ooclK3eltd6dXjhX6jJUQj/ON8uzzeyqOSCYFXVQLyg
-s5SkWVGt2CZkztVUEFp4UvH4vNbcp0BXgk8vCRbeW4hCqmc+H4u3bqkeahKoNZ8o
-hSMpOiAOzYk+c0Do1hsCAwEAAaOCAQ0wggEJMB0GA1UdDgQWBBS3rdmJTZNo0NbL
-S9tt1ssDdIVLrDCBmgYDVR0jBIGSMIGPgBSqRDqiBaIE62Lg5fUsRMo7z02ydKFs
+NTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1MZpEUUvMrAgjS0PXF42EO9j
+N2oDtGKGaI/7coeRFV+OtSUM0bPAVyi1VtiLvMD17YrQ+1ZFkcquoy/xNr9UkcaT
+BGgXJ+WW/ZKvj1tiZfctbVrcLwVEt33eSSYL7Alx0L05l1sKyIBba6oZjLLfc+rO
+o0ixsro/WD91hrCcTFsCAwEAAaOCAR0wggEZMB0GA1UdDgQWBBRSyF0oCsMaI+dS
+Fxpn6+8PvJ8PpzCBmgYDVR0jBIGSMIGPgBRiCl8euq0LHhN6yrRcEmQfv0TGsKFs
 pGowaDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzARBgNVBAcT
 Ck1lbmxvIFBhcmsxDTALBgNVBAoTBHBrZzUxDDAKBgNVBAMTA3RhNTESMBAGCSqG
-SIb3DQEJARYDdGE1ggkAyyo2lxdPYCQwDwYDVR0TAQH/BAUwAwEB/zA6BgNVHR8E
+SIb3DQEJARYDdGE1ggkA4KEAYK5XlrIwDwYDVR0TAQH/BAUwAwEB/zA6BgNVHR8E
 MzAxMC+gLaArhilodHRwOi8vbG9jYWxob3N0OjEyMDAxL2ZpbGUvMC90YTVfY3Js
-LnBlbTANBgkqhkiG9w0BAQsFAAOBgQCT4DPkkFSUbMuCjRgW7+W0gBYh+fBuX2M2
-dsHANxPK3+Jt9DBcEFyG+3vcb3++1e2bZfwU0vOM3yHbZYhge/w8b8hr/l3HfrTH
-dVSJDQFKDRrx8lxlxxIWmN33iUJqhaSmPBkiu5m2ftIqx4Bnaw/O8MkbpV059PLw
-60jqwImw3w==
+LnBlbTAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADgYEAl6VaZCm9JPWx
+JxGDL+eppfMLK7NDH3TIVPpWW097oju8202mxwf7Ui2RN2r78ccqVD0xeIWl8xC/
+BS5Iu73t1x18MbVMQXmX1i4CG4R3JEdXAFaniRz1bdPY2mmjuSvSc8DUqMGGT7oE
+K+ovC6Qdg3ECtUeHE+xmu4dqr8IdB10=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA2_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA2_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,26 +1,26 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 17 (0x11)
+        Serial Number: 22 (0x16)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Validity
-            Not Before: Aug  4 20:59:27 2010 GMT
-            Not After : Apr 30 20:59:27 2013 GMT
+            Not Before: Jan 28 02:54:20 2011 GMT
+            Not After : Oct 24 02:54:20 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta3/emailAddress=pubCA2_ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:91:27:b7:93:9d:5d:e5:9e:e9:5d:78:e2:1d:ff:
-                    73:0e:d7:a7:4e:a3:bf:e3:ff:33:08:c9:a9:e4:6f:
-                    bc:a5:b9:33:32:29:8f:da:d1:63:51:0c:3b:da:84:
-                    32:bb:74:28:70:d3:07:3b:3d:ac:2f:7d:c2:9e:4a:
-                    4e:7c:34:37:e6:1d:76:aa:44:a0:56:c9:83:83:13:
-                    7e:67:91:99:af:5d:5a:36:5d:a6:20:23:4a:f5:a8:
-                    08:12:5e:49:52:4b:ae:d3:e6:b4:63:f8:2e:1d:80:
-                    5f:bd:1f:58:75:34:92:ce:be:6a:3b:f8:25:fd:64:
-                    49:b6:fe:6b:03:dc:0c:9e:4f
+                    00:b8:c0:ed:3f:ee:b2:c4:82:85:82:6e:dc:d2:63:
+                    72:d9:d7:73:bf:24:bc:5a:ab:9a:aa:39:dc:01:23:
+                    95:40:8b:1c:c4:08:e1:3a:20:a9:f3:21:e4:ca:e9:
+                    c8:be:48:52:34:35:5f:af:19:60:89:7a:4f:95:e2:
+                    c2:dc:0a:f2:7a:7d:62:ce:d5:39:55:4e:10:d8:da:
+                    90:48:73:69:64:ef:7d:a9:57:a2:f2:6d:e6:db:d0:
+                    a3:df:2a:a1:c1:f4:c6:44:32:bc:af:d9:bb:5e:c1:
+                    39:10:27:fd:1e:6e:9f:dc:65:63:1c:9c:bd:3b:b1:
+                    8f:9a:da:82:6e:5b:71:a0:97
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: critical
@@ -29,27 +29,27 @@
                 <EMPTY>
 
     Signature Algorithm: sha256WithRSAEncryption
-        07:01:15:2c:e6:eb:e6:8a:b4:dc:6c:fa:f5:30:2d:32:e1:6f:
-        27:76:6d:1e:c8:4b:e1:ae:f8:96:fb:15:0e:0e:8f:e7:fe:43:
-        d3:af:f7:b3:f8:19:e0:77:38:43:d3:6b:86:6b:f1:b6:36:b5:
-        34:66:49:ad:c0:58:7a:40:18:da:48:af:b4:b3:24:43:92:06:
-        df:84:c2:ac:ea:c1:0d:8a:82:86:39:ce:44:1e:72:f2:46:0e:
-        c4:cf:70:78:86:a9:8f:35:83:5f:74:e1:30:a3:90:29:f2:f2:
-        5f:d1:d3:84:84:4d:1d:08:ea:05:24:2d:d0:ae:3d:0f:78:7c:
-        c7:10
+        bd:39:e7:46:37:ef:db:c9:d2:d5:af:3e:ac:5d:36:b3:c8:55:
+        3f:3a:5c:cb:54:33:bb:46:ad:90:a5:5b:29:87:31:c1:f2:7c:
+        b0:15:99:93:ce:70:3c:7d:59:8d:3e:ba:ae:f6:77:ae:ee:21:
+        0e:6b:12:de:7c:f7:12:1e:94:81:77:01:ee:3b:15:86:28:f0:
+        13:64:2f:24:fa:15:71:02:53:93:9c:aa:a6:55:f9:75:eb:27:
+        f8:09:09:af:7f:77:bf:5c:38:b1:ce:e6:46:60:36:16:83:59:
+        0d:f0:b5:b5:97:82:a7:43:d4:b5:6f:85:cd:77:4f:59:73:49:
+        9c:cb
 -----BEGIN CERTIFICATE-----
-MIICdTCCAd6gAwIBAgIBETANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIICdTCCAd6gAwIBAgIBFjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
-ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTAw
-ODA0MjA1OTI3WhcNMTMwNDMwMjA1OTI3WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMTEw
+MTI4MDI1NDIwWhcNMTMxMDI0MDI1NDIwWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTETMBEGA1UEAxQKcHViQ0EyX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0EyX3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAkSe3k51d5Z7pXXjiHf9zDten
-TqO/4/8zCMmp5G+8pbkzMimP2tFjUQw72oQyu3QocNMHOz2sL33CnkpOfDQ35h12
-qkSgVsmDgxN+Z5GZr11aNl2mICNK9agIEl5JUkuu0+a0Y/guHYBfvR9YdTSSzr5q
-O/gl/WRJtv5rA9wMnk8CAwEAAaMhMB8wDwYDVR0TAQH/BAUwAwEB/zAMBgNVHRIB
-Af8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAAcBFSzm6+aKtNxs+vUwLTLhbyd2bR7I
-S+Gu+Jb7FQ4Oj+f+Q9Ov97P4GeB3OEPTa4Zr8bY2tTRmSa3AWHpAGNpIr7SzJEOS
-Bt+EwqzqwQ2KgoY5zkQecvJGDsTPcHiGqY81g1904TCjkCny8l/R04SETR0I6gUk
-LdCuPQ94fMcQ
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAuMDtP+6yxIKFgm7c0mNy2ddz
+vyS8WquaqjncASOVQIscxAjhOiCp8yHkyunIvkhSNDVfrxlgiXpPleLC3Aryen1i
+ztU5VU4Q2NqQSHNpZO99qVei8m3m29Cj3yqhwfTGRDK8r9m7XsE5ECf9Hm6f3GVj
+HJy9O7GPmtqCbltxoJcCAwEAAaMhMB8wDwYDVR0TAQH/BAUwAwEB/zAMBgNVHRIB
+Af8EAjAAMA0GCSqGSIb3DQEBCwUAA4GBAL0550Y379vJ0tWvPqxdNrPIVT86XMtU
+M7tGrZClWymHMcHyfLAVmZPOcDx9WY0+uq72d67uIQ5rEt589xIelIF3Ae47FYYo
+8BNkLyT6FXECU5OcqqZV+XXrJ/gJCa9/d79cOLHO5kZgNhaDWQ3wtbWXgqdD1LVv
+hc13T1lzSZzL
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA2_ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,65 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 34 (0x22)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
+        Validity
+            Not Before: Jan 28 02:54:24 2011 GMT
+            Not After : Oct 24 02:54:24 2013 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA2_ta4/emailAddress=pubCA2_ta4
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:b4:ad:43:56:c0:47:59:45:17:9b:25:94:a6:3f:
+                    07:fa:0d:8c:17:bd:1d:ea:b0:14:73:4f:ab:91:ad:
+                    e5:72:15:a8:c3:5d:d2:37:d3:1c:9f:0d:b5:b1:5d:
+                    dc:e9:ca:dd:ba:58:de:d7:10:ca:ce:f7:76:4a:da:
+                    62:87:04:00:34:ee:d2:2a:32:fa:57:0e:a3:a8:0c:
+                    f8:98:65:72:9b:65:2d:90:50:be:c0:a2:2e:33:13:
+                    55:2f:17:8f:88:83:2a:e9:e0:a1:e1:6d:43:d1:2f:
+                    a7:6b:4c:a9:67:8f:3d:9d:3c:46:91:c8:fc:b8:38:
+                    65:16:c5:60:b8:8a:7e:36:e3
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                7E:D7:20:26:1C:A5:29:A9:33:67:3B:8C:F6:91:31:8E:14:D9:C6:D6
+            X509v3 Authority Key Identifier: 
+                keyid:B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
+                serial:FC:C0:EE:93:13:43:17:2D
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign
+    Signature Algorithm: sha256WithRSAEncryption
+        8a:49:79:6d:e2:18:16:a9:63:8c:a6:4c:78:02:27:7e:2b:99:
+        1f:a0:bd:23:93:6e:32:70:f9:4c:fd:c0:9c:78:11:1c:0e:ee:
+        3c:35:c6:12:70:c3:4b:4a:25:e1:20:75:9d:a0:37:b2:db:7a:
+        62:b2:a2:a6:37:5b:e5:fd:89:ec:bd:23:03:95:38:05:da:92:
+        5e:b4:32:b2:a1:0e:c2:cb:8e:62:01:f7:b5:87:c5:39:4a:40:
+        11:e4:fe:52:c5:ac:b7:c4:ca:4d:7b:c4:3c:79:f6:6f:a0:bc:
+        04:e5:dd:38:a0:e8:86:d5:14:01:bf:f5:01:bb:cc:7a:19:39:
+        a8:ff
+-----BEGIN CERTIFICATE-----
+MIIDNTCCAp6gAwIBAgIBIjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGE0MRIwEAYJKoZIhvcNAQkBFgN0YTQwHhcNMTEw
+MTI4MDI1NDI0WhcNMTMxMDI0MDI1NDI0WjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0EyX3RhNDEZMBcGCSqGSIb3DQEJARYKcHViQ0EyX3Rh
+NDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAtK1DVsBHWUUXmyWUpj8H+g2M
+F70d6rAUc0+rka3lchWow13SN9Mcnw21sV3c6crdulje1xDKzvd2StpihwQANO7S
+KjL6Vw6jqAz4mGVym2UtkFC+wKIuMxNVLxePiIMq6eCh4W1D0S+na0ypZ489nTxG
+kcj8uDhlFsVguIp+NuMCAwEAAaOB4DCB3TAdBgNVHQ4EFgQUftcgJhylKakzZzuM
+9pExjhTZxtYwgZoGA1UdIwSBkjCBj4AUuahSX5EbKiepCpRUBlIvcoaFnnWhbKRq
+MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
+ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG
+9w0BCQEWA3RhNIIJAPzA7pMTQxctMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgIEMA0GCSqGSIb3DQEBCwUAA4GBAIpJeW3iGBapY4ymTHgCJ34rmR+gvSOT
+bjJw+Uz9wJx4ERwO7jw1xhJww0tKJeEgdZ2gN7LbemKyoqY3W+X9iey9IwOVOAXa
+kl60MrKhDsLLjmIB97WHxTlKQBHk/lLFrLfEyk17xDx59m+gvATl3Tig6IbVFAG/
+9QG7zHoZOaj/
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA3_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA3_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,7 +1,7 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 19 (0x13)
+        Serial Number: 24 (0x18)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Validity
@@ -12,51 +12,54 @@
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:95:a3:85:b5:71:f3:2f:b2:aa:c2:33:ff:4c:70:
-                    40:e1:06:44:e8:7c:0f:78:77:21:1d:a6:8a:e7:0c:
-                    e7:65:12:f5:cc:99:cf:4a:00:bd:5e:ea:4d:c7:a3:
-                    85:93:0c:4c:4a:17:44:49:d9:b9:06:45:b4:99:d0:
-                    95:08:aa:f6:c4:07:75:46:a7:26:3a:e5:01:64:26:
-                    74:c7:58:73:e9:70:4f:97:15:4e:30:bd:55:8e:cb:
-                    43:33:36:8a:f9:cc:57:e6:ee:2a:1b:aa:0e:67:51:
-                    c5:52:61:ab:43:5b:f2:d7:2c:20:5c:c1:72:a4:3a:
-                    bb:b0:a2:3b:b4:6e:e3:b9:df
+                    00:ba:b1:90:f4:fa:4e:82:56:04:92:7a:d5:d7:23:
+                    93:e4:53:47:c2:28:06:c3:a1:6e:ed:7c:02:0e:f6:
+                    73:0b:8e:11:75:33:f3:d1:98:c0:ad:37:12:b8:41:
+                    1a:57:12:95:5e:63:61:b5:69:97:60:07:6c:6e:4b:
+                    a5:19:0e:f8:ba:35:9d:7a:f0:5c:74:33:7a:78:24:
+                    cd:2f:2a:cd:31:84:17:0f:e0:4d:06:ba:92:7a:ae:
+                    d0:a9:54:80:f1:d2:4d:dc:e9:81:84:ad:c9:74:c0:
+                    88:e8:67:63:70:2a:c4:85:75:b8:32:a8:ed:af:2a:
+                    6b:63:53:97:27:d3:9d:e6:57
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                E9:26:60:80:D1:41:FF:4A:A4:0C:14:05:C0:6B:5D:84:C5:F0:15:04
+                A2:91:E3:9A:3E:C3:FD:0E:04:36:9A:5C:34:32:84:C4:91:83:7A:91
             X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
+                serial:98:29:8D:38:A1:E7:D1:02
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        7f:d0:e5:cc:61:28:7a:14:1f:6e:43:f2:1f:98:55:8f:3f:9b:
-        f4:8c:1d:2d:4d:c4:c5:08:2f:eb:1a:6d:1d:99:80:57:3b:45:
-        d3:4f:71:6f:61:ca:17:83:9f:23:5f:0a:77:7b:25:b2:53:2b:
-        ca:e3:3d:ad:28:57:99:b9:3a:d8:f8:d2:3f:55:d8:f4:ef:94:
-        81:36:58:4f:98:a0:2b:6b:8d:77:cb:3d:bd:32:9a:5e:dd:1e:
-        7f:4f:02:fe:de:35:a8:f0:85:3a:eb:a9:22:5a:dd:9d:ba:dc:
-        40:b7:9f:ba:54:f8:84:7d:39:42:ec:87:73:85:11:1d:36:41:
-        9f:e7
+        03:8e:b8:b8:48:41:bd:75:34:8c:80:37:f3:6a:54:32:9a:dd:
+        ef:55:e7:fc:b9:87:c3:1e:28:82:3c:09:09:9a:4d:d8:8e:25:
+        7b:4e:bb:b4:e9:45:61:27:25:0b:70:7a:1c:7d:14:da:4a:ff:
+        bc:9f:1c:39:47:53:b9:a3:41:b1:15:e5:f7:01:b9:0e:8b:5f:
+        a0:31:5e:4e:7d:d4:f0:ba:be:a1:b9:b3:25:d8:bb:b7:3c:0c:
+        c9:a1:2e:60:d6:4f:21:a0:6e:2e:1b:40:dd:8c:ee:07:5c:21:
+        88:f7:40:3e:4b:3d:7f:00:bf:41:89:b1:1c:45:04:49:c3:92:
+        f8:a5
 -----BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBEzANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDNTCCAp6gAwIBAgIBGDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMDkw
 MTAxMDEwMTAxWhcNMDkwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTETMBEGA1UEAxQKcHViQ0EzX3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0EzX3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAlaOFtXHzL7KqwjP/THBA4QZE
-6HwPeHchHaaK5wznZRL1zJnPSgC9XupNx6OFkwxMShdESdm5BkW0mdCVCKr2xAd1
-RqcmOuUBZCZ0x1hz6XBPlxVOML1VjstDMzaK+cxX5u4qG6oOZ1HFUmGrQ1vy1ywg
-XMFypDq7sKI7tG7jud8CAwEAAaOB0DCBzTAdBgNVHQ4EFgQU6SZggNFB/0qkDBQF
-wGtdhMXwFQQwgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRq
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAurGQ9PpOglYEknrV1yOT5FNH
+wigGw6Fu7XwCDvZzC44RdTPz0ZjArTcSuEEaVxKVXmNhtWmXYAdsbkulGQ74ujWd
+evBcdDN6eCTNLyrNMYQXD+BNBrqSeq7QqVSA8dJN3OmBhK3JdMCI6GdjcCrEhXW4
+MqjtryprY1OXJ9Od5lcCAwEAAaOB4DCB3TAdBgNVHQ4EFgQUopHjmj7D/Q4ENppc
+NDKExJGDepEwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
 MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
 ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
-9w0BCQEWA3RhM4IJAOH4Ui+s9ADuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAf9DlzGEoehQfbkPyH5hVjz+b9IwdLU3ExQgv6xptHZmAVztF009x
-b2HKF4OfI18Kd3slslMryuM9rShXmbk62PjSP1XY9O+UgTZYT5igK2uNd8s9vTKa
-Xt0ef08C/t41qPCFOuupIlrdnbrcQLefulT4hH05QuyHc4URHTZBn+c=
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAAOOuLhIQb11NIyAN/NqVDKa3e9V5/y5
+h8MeKII8CQmaTdiOJXtOu7TpRWEnJQtwehx9FNpK/7yfHDlHU7mjQbEV5fcBuQ6L
+X6AxXk591PC6vqG5syXYu7c8DMmhLmDWTyGgbi4bQN2M7gdcIYj3QD5LPX8Av0GJ
+sRxFBEnDkvil
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA4_ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA4_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -1,7 +1,7 @@
 Certificate:
     Data:
         Version: 3 (0x2)
-        Serial Number: 21 (0x15)
+        Serial Number: 26 (0x1a)
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Validity
@@ -12,51 +12,54 @@
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:b2:8a:7a:22:17:a3:be:ff:35:73:f1:13:34:e2:
-                    c1:02:e3:1e:a6:d8:bc:c2:29:a6:9d:e1:96:0b:2b:
-                    38:42:db:f4:9f:f8:05:c0:d9:81:ab:37:35:da:24:
-                    1b:e5:95:6b:c5:da:e8:c1:14:c3:c7:3e:a4:20:ce:
-                    25:75:5f:13:d4:94:4d:7c:69:42:82:ef:09:c9:b1:
-                    11:dd:a0:d9:e2:76:47:fd:68:e7:ec:11:02:f7:a6:
-                    92:da:50:b8:9d:e8:90:9d:f7:e2:d6:cd:35:7e:1c:
-                    f6:31:71:39:fe:1a:5d:49:cc:50:c7:34:fd:cb:e1:
-                    85:3a:e4:a6:15:9a:7f:6b:c5
+                    00:ca:aa:c4:0b:75:27:b8:a2:03:80:fd:5b:9d:db:
+                    1d:d1:69:1b:4e:bb:7d:c6:88:db:b6:14:5d:f6:f2:
+                    ff:45:f3:b6:74:7f:35:b6:a1:97:49:5e:8a:bc:94:
+                    36:25:d1:35:34:34:55:0a:e0:7f:e3:c1:1b:fe:27:
+                    ee:33:53:02:3b:a1:a7:99:ed:f1:d1:b8:1a:91:16:
+                    ba:83:9c:02:0d:78:0c:1c:79:59:74:bc:f1:0b:21:
+                    1a:fa:aa:55:72:a5:b4:39:99:40:1c:77:da:17:d6:
+                    6f:a2:14:61:96:5f:c5:14:d8:6c:ec:82:f9:b4:45:
+                    76:68:b2:a9:07:ee:94:df:65
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                A5:56:E6:44:AE:89:5C:8E:24:C2:58:B6:C6:D1:7B:51:BC:F4:7A:83
+                04:46:EB:13:B6:FE:E1:94:6D:9C:0E:59:20:4B:A2:6C:B1:DA:68:5C
             X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
+                serial:98:29:8D:38:A1:E7:D1:02
 
             X509v3 Basic Constraints: critical
                 CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
     Signature Algorithm: sha256WithRSAEncryption
-        65:98:33:cd:b4:af:b0:67:bf:0e:8e:0e:d6:8c:fd:a6:7c:18:
-        88:a7:2a:ac:55:5d:b3:95:f3:8f:5f:d7:00:78:cc:fd:00:6a:
-        0c:75:12:00:7b:88:f4:93:66:00:be:c7:ce:d7:75:72:0e:44:
-        3e:fc:b2:ff:d1:23:72:9c:be:a7:a7:70:d9:af:0d:e5:84:43:
-        77:6e:73:60:ff:40:f0:f6:94:17:8e:4e:57:0d:d6:35:4f:5b:
-        46:d6:36:6e:3a:03:e6:13:b9:4c:c9:fd:75:c7:e6:4f:f3:75:
-        bc:2a:38:dd:7c:9b:3c:5a:75:27:c9:00:5d:11:11:b6:4e:e9:
-        97:b9
+        06:1e:6c:15:d0:cd:28:6a:c2:c1:0e:3c:f5:8c:4e:0d:ec:53:
+        a6:d9:f0:28:06:df:e6:a6:ed:f7:e5:ab:a1:2a:02:f8:17:29:
+        1e:54:ec:83:44:ce:a5:ed:ee:70:33:83:83:1e:31:81:2b:72:
+        ee:4d:cd:d5:9c:9c:f3:0d:81:fd:5a:26:1c:c6:3b:27:a9:18:
+        41:96:ee:6b:bc:b4:06:72:1e:97:44:78:21:45:19:1d:38:8b:
+        69:8e:9e:d8:0f:7a:a4:4e:bb:49:8a:a9:37:5c:a5:98:6b:ad:
+        f3:29:f3:8c:53:10:1c:af:d9:5f:2a:c7:9a:f8:d5:ce:b1:ba:
+        dc:8d
 -----BEGIN CERTIFICATE-----
-MIIDJTCCAo6gAwIBAgIBFTANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MIIDNTCCAp6gAwIBAgIBGjANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
 MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
 ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMzUw
 MTAxMDEwMTAxWhcNMzUwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
 CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
 NTETMBEGA1UEAxQKcHViQ0E0X3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0E0X3Rh
-MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAsop6Ihejvv81c/ETNOLBAuMe
-pti8wimmneGWCys4Qtv0n/gFwNmBqzc12iQb5ZVrxdrowRTDxz6kIM4ldV8T1JRN
-fGlCgu8JybER3aDZ4nZH/Wjn7BEC96aS2lC4neiQnffi1s01fhz2MXE5/hpdScxQ
-xzT9y+GFOuSmFZp/a8UCAwEAAaOB0DCBzTAdBgNVHQ4EFgQUpVbmRK6JXI4kwli2
-xtF7Ubz0eoMwgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRq
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyqrEC3UnuKIDgP1bndsd0Wkb
+Trt9xojbthRd9vL/RfO2dH81tqGXSV6KvJQ2JdE1NDRVCuB/48Eb/ifuM1MCO6Gn
+me3x0bgakRa6g5wCDXgMHHlZdLzxCyEa+qpVcqW0OZlAHHfaF9ZvohRhll/FFNhs
+7IL5tEV2aLKpB+6U32UCAwEAAaOB4DCB3TAdBgNVHQ4EFgQUBEbrE7b+4ZRtnA5Z
+IEuibLHaaFwwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
 MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
 ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
-9w0BCQEWA3RhM4IJAOH4Ui+s9ADuMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
-AQELBQADgYEAZZgzzbSvsGe/Do4O1oz9pnwYiKcqrFVds5Xzj1/XAHjM/QBqDHUS
-AHuI9JNmAL7Hztd1cg5EPvyy/9Ejcpy+p6dw2a8N5YRDd25zYP9A8PaUF45OVw3W
-NU9bRtY2bjoD5hO5TMn9dcfmT/N1vCo43XybPFp1J8kAXRERtk7pl7k=
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
+BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4GBAAYebBXQzShqwsEOPPWMTg3sU6bZ8CgG
+3+am7fflq6EqAvgXKR5U7INEzqXt7nAzg4MeMYErcu5NzdWcnPMNgf1aJhzGOyep
+GEGW7mu8tAZyHpdEeCFFGR04i2mOntgPeqROu0mKqTdcpZhrrfMp84xTEByv2V8q
+x5r41c6xutyN
 -----END CERTIFICATE-----
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/tests/ro_data/signing_certs/produced/publisher_cas/pubCA5_ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -0,0 +1,62 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 28 (0x1c)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
+        Validity
+            Not Before: Jan  1 01:01:01 2035 GMT
+            Not After : Jan  2 01:01:01 2035 GMT
+        Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=pubCA5_ta3/emailAddress=pubCA5_ta3
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+            RSA Public Key: (1024 bit)
+                Modulus (1024 bit):
+                    00:c1:7d:e8:01:87:c0:29:55:4f:e7:82:49:3f:d3:
+                    58:23:af:60:58:22:68:d9:fe:67:b4:69:9e:48:ee:
+                    b9:05:dc:31:85:9d:5e:ba:2f:19:61:97:20:d5:99:
+                    d9:84:67:50:ce:bf:1b:ef:86:07:70:0e:fd:3f:22:
+                    a9:16:10:d6:2d:f6:30:23:36:54:28:16:33:d5:58:
+                    6c:15:fb:79:2e:af:07:43:77:11:bb:54:e9:e3:e5:
+                    5c:5b:5a:67:6f:bb:43:08:4e:c3:a8:77:06:25:92:
+                    10:cc:cb:1d:4a:7d:07:1e:83:1e:43:59:bc:b5:56:
+                    18:f6:2e:8a:4e:52:bf:fe:c1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                18:C6:4D:FD:87:0A:06:7E:55:86:3A:77:4F:0F:F7:33:67:02:F5:33
+            X509v3 Authority Key Identifier: 
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
+                DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
+                serial:98:29:8D:38:A1:E7:D1:02
+
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+        09:28:d6:10:c6:de:9d:66:c1:a9:d4:83:53:d9:ba:27:a1:64:
+        ae:29:c2:07:42:33:b4:3c:1d:e1:8c:0a:c8:38:98:c8:89:d8:
+        98:26:41:75:56:b0:fa:30:d3:b8:ad:9f:47:7b:23:ec:da:99:
+        ff:8f:a7:18:56:43:13:bf:ee:19:0f:d8:70:c7:fe:4e:0b:1c:
+        54:e4:af:d5:01:72:a8:19:5e:21:ed:17:90:a1:fe:51:74:c6:
+        ba:29:89:e2:74:16:df:a8:89:7a:b3:ce:50:5f:9d:99:e7:76:
+        c0:98:38:03:c2:a5:bb:88:bd:57:bc:4d:59:ce:cd:e0:c6:ad:
+        3c:2c
+-----BEGIN CERTIFICATE-----
+MIIDJTCCAo6gAwIBAgIBHDANBgkqhkiG9w0BAQsFADBoMQswCQYDVQQGEwJVUzET
+MBEGA1UECBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UE
+ChMEcGtnNTEMMAoGA1UEAxMDdGEzMRIwEAYJKoZIhvcNAQkBFgN0YTMwHhcNMzUw
+MTAxMDEwMTAxWhcNMzUwMTAyMDEwMTAxWjB2MQswCQYDVQQGEwJVUzETMBEGA1UE
+CBMKQ2FsaWZvcm5pYTETMBEGA1UEBxMKTWVubG8gUGFyazENMAsGA1UEChMEcGtn
+NTETMBEGA1UEAxQKcHViQ0E1X3RhMzEZMBcGCSqGSIb3DQEJARYKcHViQ0E1X3Rh
+MzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwX3oAYfAKVVP54JJP9NYI69g
+WCJo2f5ntGmeSO65BdwxhZ1eui8ZYZcg1ZnZhGdQzr8b74YHcA79PyKpFhDWLfYw
+IzZUKBYz1VhsFft5Lq8HQ3cRu1Tp4+VcW1pnb7tDCE7DqHcGJZIQzMsdSn0HHoMe
+Q1m8tVYY9i6KTlK//sECAwEAAaOB0DCBzTAdBgNVHQ4EFgQUGMZN/YcKBn5Vhjp3
+Tw/3M2cC9TMwgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRq
+MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpN
+ZW5sbyBQYXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG
+9w0BCQEWA3RhM4IJAJgpjTih59ECMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcN
+AQELBQADgYEACSjWEMbenWbBqdSDU9m6J6FkrinCB0IztDwd4YwKyDiYyInYmCZB
+dVaw+jDTuK2fR3sj7NqZ/4+nGFZDE7/uGQ/YcMf+TgscVOSv1QFyqBleIe0XkKH+
+UXTGuimJ4nQW36iJerPOUF+dmed2wJg4A8Klu4i9V7xNWc7N4MatPCw=
+-----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/serial	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/serial	Tue Feb 08 23:55:15 2011 -0800
@@ -1,1 +1,1 @@
-1D
+26
--- a/src/tests/ro_data/signing_certs/produced/ta1/ta1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/ta1/ta1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            cb:cf:1d:cd:f3:a6:cd:09
+            c1:e4:f1:a8:14:c7:a7:58
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta1/emailAddress=ta1
         Validity
-            Not Before: Aug  4 20:59:22 2010 GMT
-            Not After : Apr 30 20:59:22 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta1/emailAddress=ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:a7:64:67:53:f2:9a:c9:ce:a9:4a:92:16:57:61:
-                    c3:af:9d:0e:9f:61:82:ad:cf:7f:aa:59:f2:fa:06:
-                    3d:a2:ad:4f:db:90:3e:48:3e:00:d4:eb:96:c2:19:
-                    b3:e0:6a:f2:21:61:83:92:dd:86:50:ff:c6:3f:de:
-                    22:9c:1c:74:cb:09:06:e7:78:c2:8c:f8:98:2e:b5:
-                    e4:c2:f4:bf:b7:92:46:af:c7:d6:6c:59:07:d9:8c:
-                    06:96:1b:ef:10:dc:3e:f8:8b:08:9d:bd:81:3c:0d:
-                    a3:e9:55:5f:1b:04:39:b9:7f:f4:cf:d6:f9:a2:31:
-                    3a:83:96:21:92:a7:13:c4:4d
+                    00:a4:e5:50:4f:dd:85:ff:70:fd:e9:82:c0:b4:44:
+                    4e:3f:50:5e:32:57:52:9e:1d:ce:96:a4:36:38:5f:
+                    2c:c0:41:27:a7:4d:f4:04:d8:05:71:b3:56:a4:09:
+                    32:26:38:f8:17:a6:d7:e8:4c:f6:64:56:e0:fb:fa:
+                    6b:41:44:9c:06:fe:f1:99:35:d5:bb:66:8c:12:f6:
+                    ab:cd:90:02:df:94:97:5e:8c:94:89:8a:8f:2e:8b:
+                    8a:3c:0a:85:2f:9a:25:34:ad:b4:82:e4:04:4d:a8:
+                    8b:dc:b4:42:58:3d:c1:0f:85:28:d7:25:22:02:b8:
+                    09:f2:23:2e:57:eb:dd:e3:31
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                BB:C9:C7:62:4B:87:B7:6A:32:3F:A5:51:7B:C1:3A:8E:3F:06:5C:F7
+                15:AB:A2:AB:34:BD:EB:C4:C9:AE:0D:82:51:00:DD:2D:B1:1D:1A:7B
             X509v3 Authority Key Identifier: 
-                keyid:BB:C9:C7:62:4B:87:B7:6A:32:3F:A5:51:7B:C1:3A:8E:3F:06:5C:F7
+                keyid:15:AB:A2:AB:34:BD:EB:C4:C9:AE:0D:82:51:00:DD:2D:B1:1D:1A:7B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta1/emailAddress=ta1
-                serial:CB:CF:1D:CD:F3:A6:CD:09
+                serial:C1:E4:F1:A8:14:C7:A7:58
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        07:cb:90:df:b3:18:22:61:79:1d:39:67:ee:3d:94:a8:7b:e1:
-        64:52:41:4a:1f:6e:14:34:b9:27:aa:05:77:f9:38:0c:66:20:
-        cf:92:0e:4e:94:bf:62:f1:2d:08:1c:ca:3e:77:5a:07:e9:35:
-        bb:a7:ca:31:8a:44:10:a9:56:f4:96:81:84:52:2c:36:45:ea:
-        72:46:6c:4a:ca:05:8c:79:d1:03:93:84:96:e4:fa:7b:5d:59:
-        21:9f:87:4d:ab:f1:64:e0:92:14:59:c6:c4:d8:3c:33:64:58:
-        98:96:83:f1:a6:26:fd:54:57:d7:f9:71:3c:83:d6:9b:ab:2a:
-        34:2f
+        4c:dc:c9:ca:75:c0:d1:87:da:b1:43:63:b9:41:2c:d1:05:78:
+        17:80:0a:63:8e:ea:a8:2a:8b:84:75:2a:ef:17:d1:5e:d9:78:
+        c5:4f:fb:b1:cb:16:93:fe:1b:b1:4f:4c:f2:b8:80:60:1a:34:
+        ff:d2:c3:99:6a:94:4a:00:4b:08:ea:b1:a6:1c:61:d1:8c:a3:
+        05:08:34:24:c7:6d:4a:7a:af:b0:1b:62:55:38:0d:fb:5e:ce:
+        4b:49:6f:c1:1b:0c:a6:7b:00:a8:e9:42:37:6b:1f:4c:4e:c6:
+        52:9c:cd:f0:86:39:68:b8:a4:51:e6:9a:4a:70:ef:60:e7:51:
+        7d:4a
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAMvPHc3zps0JMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAMHk8agUx6dYMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTExEjAQBgkqhkiG9w0BCQEWA3Rh
-MTAeFw0xMDA4MDQyMDU5MjJaFw0xMzA0MzAyMDU5MjJaMGgxCzAJBgNVBAYTAlVT
+MTAeFw0xMTAxMjgwMjU0MTBaFw0xMzEwMjQwMjU0MTBaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTExEjAQBgkqhkiG9w0BCQEWA3RhMTCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAp2RnU/Kayc6pSpIWV2HDr50On2GCrc9/
-qlny+gY9oq1P25A+SD4A1OuWwhmz4GryIWGDkt2GUP/GP94inBx0ywkG53jCjPiY
-LrXkwvS/t5JGr8fWbFkH2YwGlhvvENw++IsInb2BPA2j6VVfGwQ5uX/0z9b5ojE6
-g5YhkqcTxE0CAwEAAaOBzTCByjAdBgNVHQ4EFgQUu8nHYkuHt2oyP6VRe8E6jj8G
-XPcwgZoGA1UdIwSBkjCBj4AUu8nHYkuHt2oyP6VRe8E6jj8GXPehbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApOVQT92F/3D96YLAtEROP1BeMldSnh3O
+lqQ2OF8swEEnp030BNgFcbNWpAkyJjj4F6bX6Ez2ZFbg+/prQUScBv7xmTXVu2aM
+EvarzZAC35SXXoyUiYqPLouKPAqFL5olNK20guQETaiL3LRCWD3BD4Uo1yUiArgJ
+8iMuV+vd4zECAwEAAaOBzTCByjAdBgNVHQ4EFgQUFauiqzS968TJrg2CUQDdLbEd
+GnswgZoGA1UdIwSBkjCBj4AUFauiqzS968TJrg2CUQDdLbEdGnuhbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTExEjAQBgkqhkiG9w0BCQEW
-A3RhMYIJAMvPHc3zps0JMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-B8uQ37MYImF5HTln7j2UqHvhZFJBSh9uFDS5J6oFd/k4DGYgz5IOTpS/YvEtCBzK
-PndaB+k1u6fKMYpEEKlW9JaBhFIsNkXqckZsSsoFjHnRA5OEluT6e11ZIZ+HTavx
-ZOCSFFnGxNg8M2RYmJaD8aYm/VRX1/lxPIPWm6sqNC8=
+A3RhMYIJAMHk8agUx6dYMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+TNzJynXA0YfasUNjuUEs0QV4F4AKY47qqCqLhHUq7xfRXtl4xU/7scsWk/4bsU9M
+8riAYBo0/9LDmWqUSgBLCOqxphxh0YyjBQg0JMdtSnqvsBtiVTgN+17OS0lvwRsM
+pnsAqOlCN2sfTE7GUpzN8IY5aLikUeaaSnDvYOdRfUo=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/ta2/ta2_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/ta2/ta2_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            b0:ef:ff:7c:38:9b:09:88
+            a3:0a:29:bc:c4:1c:d8:4c
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta2/emailAddress=ta2
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta2/emailAddress=ta2
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:be:3e:9c:d8:84:82:5e:4b:9f:9c:0e:64:8c:9f:
-                    d0:84:d8:e4:ef:5e:0e:c2:83:94:e0:ef:6f:5a:91:
-                    3e:c5:b9:1b:cf:a5:8c:d8:39:7f:11:d3:51:1f:b7:
-                    7c:79:0e:0f:f4:0e:1d:34:49:70:cc:01:09:34:ff:
-                    cb:79:77:84:39:d9:bf:67:2c:e2:15:88:a7:9a:ec:
-                    ae:47:67:1a:72:fb:1d:be:60:26:3a:22:8e:b5:26:
-                    3d:04:c3:c6:23:87:4d:3c:34:58:5d:9a:f6:a1:a0:
-                    61:da:a6:c0:06:3e:c3:6b:db:f4:cb:7a:ef:f7:44:
-                    ef:b1:37:e3:86:31:70:fc:9b
+                    00:d6:3a:84:18:7a:d6:3a:ee:7d:4c:75:0a:18:f4:
+                    ce:c0:2c:b5:59:eb:bd:83:0c:3c:59:90:0c:35:b9:
+                    c8:55:a4:c1:04:88:41:c4:40:a8:73:4e:f1:e4:db:
+                    84:aa:bb:03:7b:e1:5e:5d:91:a0:ee:22:3d:f3:84:
+                    35:09:de:a9:07:69:35:e6:8f:65:c4:55:70:52:a6:
+                    5f:36:ff:6a:d3:7c:c5:6c:d3:cb:4f:a1:d8:94:68:
+                    14:49:32:93:4c:ad:ac:09:25:c5:b4:e5:92:c4:5d:
+                    f5:d0:49:54:dc:e6:df:80:6f:c2:86:34:39:0e:e6:
+                    a8:9b:6b:32:21:41:ca:7b:ad
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                F2:36:95:27:CB:21:43:55:A4:D6:1D:C0:D5:1C:39:64:1F:7B:59:28
+                D5:27:DA:4C:ED:2E:83:84:C3:2A:A9:98:E6:88:24:2A:03:01:CF:D5
             X509v3 Authority Key Identifier: 
-                keyid:F2:36:95:27:CB:21:43:55:A4:D6:1D:C0:D5:1C:39:64:1F:7B:59:28
+                keyid:D5:27:DA:4C:ED:2E:83:84:C3:2A:A9:98:E6:88:24:2A:03:01:CF:D5
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta2/emailAddress=ta2
-                serial:B0:EF:FF:7C:38:9B:09:88
+                serial:A3:0A:29:BC:C4:1C:D8:4C
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        2b:16:de:59:9f:d5:d6:88:9c:0c:10:8b:cd:9e:43:b6:d7:a8:
-        cc:4c:12:fb:88:b2:cd:99:f2:a9:d7:0d:2d:fc:48:26:bc:41:
-        09:58:14:a2:79:52:41:6d:94:4c:9b:ce:75:6d:14:4d:e8:43:
-        4a:7d:27:c9:e9:e0:76:2b:ca:4e:9b:af:12:34:83:0c:d5:15:
-        f6:a6:29:89:6e:56:49:ff:27:3c:08:bb:68:29:9e:77:09:f9:
-        1a:67:2a:f5:75:c7:f0:4b:1c:c3:6a:0e:06:50:04:e7:65:83:
-        f6:81:10:a3:4a:a5:96:ef:90:2f:ef:73:57:86:6d:10:ac:2a:
-        34:9d
+        23:44:91:7e:24:18:05:e5:1f:05:7b:e1:ca:e2:a5:b9:f0:16:
+        04:b2:2c:7d:1b:a7:7f:eb:9e:71:95:ab:8d:46:65:30:b5:3f:
+        af:e5:39:0e:2d:83:30:80:a0:cb:a7:f7:a4:41:5c:7e:d9:41:
+        ef:7b:d2:b6:dd:9e:37:d4:d4:ac:c7:ee:06:42:69:02:88:b2:
+        97:60:bc:95:c5:ca:c9:59:8a:d6:35:3f:b6:09:58:62:e7:c3:
+        a3:f9:f7:4e:10:30:94:05:91:0c:cb:f7:11:17:5e:7d:bf:99:
+        ca:1d:ca:08:58:f8:a0:ea:26:0e:44:ce:cc:4a:34:b8:6a:9e:
+        88:ac
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJALDv/3w4mwmIMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAKMKKbzEHNhMMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTIxEjAQBgkqhkiG9w0BCQEWA3Rh
-MjAeFw0xMDA4MDQyMDU5MjVaFw0xMzA0MzAyMDU5MjVaMGgxCzAJBgNVBAYTAlVT
+MjAeFw0xMTAxMjgwMjU0MTNaFw0xMzEwMjQwMjU0MTNaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTIxEjAQBgkqhkiG9w0BCQEWA3RhMjCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvj6c2ISCXkufnA5kjJ/QhNjk714OwoOU
-4O9vWpE+xbkbz6WM2Dl/EdNRH7d8eQ4P9A4dNElwzAEJNP/LeXeEOdm/ZyziFYin
-muyuR2cacvsdvmAmOiKOtSY9BMPGI4dNPDRYXZr2oaBh2qbABj7Da9v0y3rv90Tv
-sTfjhjFw/JsCAwEAAaOBzTCByjAdBgNVHQ4EFgQU8jaVJ8shQ1Wk1h3A1Rw5ZB97
-WSgwgZoGA1UdIwSBkjCBj4AU8jaVJ8shQ1Wk1h3A1Rw5ZB97WSihbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1jqEGHrWOu59THUKGPTOwCy1Weu9gww8
+WZAMNbnIVaTBBIhBxECoc07x5NuEqrsDe+FeXZGg7iI984Q1Cd6pB2k15o9lxFVw
+UqZfNv9q03zFbNPLT6HYlGgUSTKTTK2sCSXFtOWSxF310ElU3ObfgG/ChjQ5Duao
+m2syIUHKe60CAwEAAaOBzTCByjAdBgNVHQ4EFgQU1SfaTO0ug4TDKqmY5ogkKgMB
+z9UwgZoGA1UdIwSBkjCBj4AU1SfaTO0ug4TDKqmY5ogkKgMBz9WhbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTIxEjAQBgkqhkiG9w0BCQEW
-A3RhMoIJALDv/3w4mwmIMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-KxbeWZ/V1oicDBCLzZ5DtteozEwS+4iyzZnyqdcNLfxIJrxBCVgUonlSQW2UTJvO
-dW0UTehDSn0nyengdivKTpuvEjSDDNUV9qYpiW5WSf8nPAi7aCmedwn5Gmcq9XXH
-8Escw2oOBlAE52WD9oEQo0qllu+QL+9zV4ZtEKwqNJ0=
+A3RhMoIJAKMKKbzEHNhMMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+I0SRfiQYBeUfBXvhyuKlufAWBLIsfRunf+uecZWrjUZlMLU/r+U5Di2DMICgy6f3
+pEFcftlB73vStt2eN9TUrMfuBkJpAoiyl2C8lcXKyVmK1jU/tglYYufDo/n3ThAw
+lAWRDMv3ERdefb+Zyh3KCFj4oOomDkTOzEo0uGqeiKw=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/ta3/ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/ta3/ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            e1:f8:52:2f:ac:f4:00:ee
+            98:29:8d:38:a1:e7:d1:02
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:cc:32:e7:d2:0d:be:82:1f:48:cb:d7:74:53:c9:
-                    7a:84:99:2a:d2:d0:01:ac:e2:26:a3:8c:02:ac:d8:
-                    51:13:31:1d:c6:4c:93:74:84:9d:e7:32:87:aa:88:
-                    db:ed:41:69:ee:5d:cd:71:bf:3b:c3:45:58:c2:c7:
-                    38:3e:e6:8e:a3:7e:d7:d0:57:fb:53:a9:c3:9d:51:
-                    6b:49:43:73:ea:69:18:9f:3a:f2:42:9c:3c:7b:13:
-                    21:f5:b8:b4:9c:58:fc:ea:a7:bd:3f:53:45:89:64:
-                    8d:56:13:3b:4e:26:d1:f9:ca:3a:8d:5e:73:ce:7f:
-                    0d:b1:8d:c2:e1:96:04:33:b1
+                    00:ee:7d:c2:8c:0e:23:2b:7d:b5:b9:51:ca:8f:45:
+                    37:2a:21:5b:2d:d6:ec:57:c5:fa:ac:f1:39:63:d3:
+                    6d:40:39:cc:53:23:a5:a5:72:6e:1a:f0:bc:e5:0b:
+                    fb:0d:82:40:b4:61:d7:a9:1b:b4:4a:55:62:cf:4e:
+                    3c:a6:39:65:fa:74:f9:91:8c:b9:0e:01:2b:cd:34:
+                    87:a7:76:f7:02:dd:ed:81:77:ca:d5:c7:9c:b8:03:
+                    a7:81:7e:c0:bf:14:32:7b:82:50:69:15:03:b0:7c:
+                    5d:66:d4:d1:58:70:0a:90:0c:97:b7:ab:64:30:45:
+                    5f:a8:7a:27:82:89:88:98:0d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
             X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
+                serial:98:29:8D:38:A1:E7:D1:02
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        b2:f7:78:f6:be:21:e5:91:f2:59:f5:9c:18:a8:3f:02:8b:39:
-        f0:80:84:ac:ed:12:70:83:2f:af:49:3a:6f:00:e8:15:e7:f4:
-        63:7a:53:08:3f:c1:66:bf:61:e9:a0:99:24:4b:93:62:e0:bd:
-        8a:ed:3f:4a:5a:09:6e:51:2e:53:67:f7:02:e0:4a:17:bb:d2:
-        a5:be:ab:e3:de:73:73:a3:ef:9d:ab:af:31:9b:bd:3c:01:9d:
-        08:14:83:44:07:59:86:96:92:59:fe:97:0c:37:9d:da:a1:af:
-        49:77:b4:72:a6:b7:8a:46:9f:ac:f3:db:ff:05:d8:15:4d:46:
-        fb:b5
+        b0:3d:ff:8a:38:de:32:30:4e:1f:f3:ba:2f:f9:4d:c4:20:31:
+        f9:5d:3e:38:91:c8:f9:ce:84:ed:3a:16:52:29:2c:4b:6c:5f:
+        f3:5d:76:c8:23:cb:be:8c:ba:26:f2:09:53:79:dd:67:28:aa:
+        f8:3a:19:ff:9a:47:d8:67:93:0a:fe:1d:ae:b4:71:2d:e8:52:
+        d9:78:1b:d9:5c:a0:8e:e9:ff:6a:f3:92:5c:5a:8f:12:3d:29:
+        35:c9:16:de:e7:94:6b:58:20:85:85:9e:31:d7:80:9a:e0:a8:
+        dc:e9:61:b0:4e:aa:7f:10:d4:90:e2:39:ca:b0:93:02:03:53:
+        89:6f
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAOH4Ui+s9ADuMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAJgpjTih59ECMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG9w0BCQEWA3Rh
-MzAeFw0xMDA4MDQyMDU5MjVaFw0xMzA0MzAyMDU5MjVaMGgxCzAJBgNVBAYTAlVT
+MzAeFw0xMTAxMjgwMjU0MTNaFw0xMzEwMjQwMjU0MTNaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG9w0BCQEWA3RhMzCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzDLn0g2+gh9Iy9d0U8l6hJkq0tABrOIm
-o4wCrNhREzEdxkyTdISd5zKHqojb7UFp7l3Ncb87w0VYwsc4PuaOo37X0Ff7U6nD
-nVFrSUNz6mkYnzryQpw8exMh9bi0nFj86qe9P1NFiWSNVhM7TibR+co6jV5zzn8N
-sY3C4ZYEM7ECAwEAAaOBzTCByjAdBgNVHQ4EFgQU4M5mZldwNxav62W2FdwtLLe0
-SU0wgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA7n3CjA4jK321uVHKj0U3KiFbLdbsV8X6
+rPE5Y9NtQDnMUyOlpXJuGvC85Qv7DYJAtGHXqRu0SlViz048pjll+nT5kYy5DgEr
+zTSHp3b3At3tgXfK1cecuAOngX7AvxQye4JQaRUDsHxdZtTRWHAKkAyXt6tkMEVf
+qHongomImA0CAwEAAaOBzTCByjAdBgNVHQ4EFgQU3/HDQuQnIeA7HeCFRx8WNU1Y
+8x4wgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG9w0BCQEW
-A3RhM4IJAOH4Ui+s9ADuMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-svd49r4h5ZHyWfWcGKg/Aos58ICErO0ScIMvr0k6bwDoFef0Y3pTCD/BZr9h6aCZ
-JEuTYuC9iu0/SloJblEuU2f3AuBKF7vSpb6r495zc6PvnauvMZu9PAGdCBSDRAdZ
-hpaSWf6XDDed2qGvSXe0cqa3ikafrPPb/wXYFU1G+7U=
+A3RhM4IJAJgpjTih59ECMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+sD3/ijjeMjBOH/O6L/lNxCAx+V0+OJHI+c6E7ToWUiksS2xf8112yCPLvoy6JvIJ
+U3ndZyiq+DoZ/5pH2GeTCv4drrRxLehS2Xgb2Vygjun/avOSXFqPEj0pNckW3ueU
+a1gghYWeMdeAmuCo3OlhsE6qfxDUkOI5yrCTAgNTiW8=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/ta4/ta4_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/ta4/ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            c0:c8:77:b4:4c:49:4f:ab
+            fc:c0:ee:93:13:43:17:2d
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
         Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:9f:46:1a:e5:09:98:a6:bd:cf:b6:5c:20:fc:82:
-                    d7:86:d2:d0:97:20:c6:12:a5:5f:6c:7a:2c:9a:68:
-                    4c:ba:75:32:09:fe:d5:b3:5b:6a:d4:fb:95:aa:bf:
-                    5a:36:c3:2e:57:3d:d1:f4:87:4c:8a:66:10:89:39:
-                    d8:b9:2f:1a:3f:37:fa:06:d0:e2:5d:3f:06:8b:a4:
-                    6e:85:4f:64:8f:72:05:fb:fe:aa:07:f5:ad:b0:49:
-                    c5:36:ee:96:c0:49:58:88:f5:a2:2f:3b:90:7d:b8:
-                    1e:d7:b0:67:cd:b9:38:05:8d:a7:94:8c:40:33:0b:
-                    1f:7d:03:dc:99:c1:55:49:59
+                    00:c0:2b:f2:13:a5:29:e8:19:ed:15:b7:ef:65:2a:
+                    33:bc:aa:23:17:07:4f:e2:b8:c2:fc:e8:f0:36:d2:
+                    71:55:fe:45:15:4f:62:3d:0b:f6:1a:4e:6c:7c:59:
+                    09:06:10:6e:f6:17:1c:96:4e:d6:ce:fa:b8:b6:a4:
+                    36:97:95:dc:49:87:ce:ed:10:1a:f8:ca:b9:8f:3e:
+                    d4:e6:89:64:27:01:1d:e0:56:9d:71:55:7b:f1:53:
+                    eb:16:b9:d6:3c:f4:35:3f:a5:23:b7:50:1e:d8:0d:
+                    67:af:fb:65:77:55:34:0f:a9:cf:35:9a:bc:ea:ed:
+                    cb:7c:5c:9f:61:1a:96:ea:a3
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                FE:14:53:EF:9C:0B:AB:ED:96:22:70:11:C2:E6:7D:2E:40:B7:7F:B5
+                B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
             X509v3 Authority Key Identifier: 
-                keyid:FE:14:53:EF:9C:0B:AB:ED:96:22:70:11:C2:E6:7D:2E:40:B7:7F:B5
+                keyid:B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:C0:C8:77:B4:4C:49:4F:AB
+                serial:FC:C0:EE:93:13:43:17:2D
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        42:b3:66:1a:56:fd:34:a0:2c:92:6d:ee:3f:e0:c1:c2:c6:8b:
-        e0:d5:dd:31:9b:e2:7b:9d:fd:e4:b2:71:72:fd:32:8d:59:a1:
-        36:ea:6a:45:d5:80:d4:79:75:4f:fc:50:34:8c:c1:5b:15:0e:
-        39:fd:40:99:fd:37:12:fa:d2:6a:1a:b9:66:db:7c:a0:54:e0:
-        fa:e3:03:c6:40:cf:71:4e:e4:e9:c2:cb:db:31:3a:a7:0a:5c:
-        97:0a:78:e5:50:03:ac:6d:e3:df:07:11:cd:73:5a:75:95:a7:
-        40:c0:51:28:9b:f1:a6:1a:1c:db:9e:1b:0a:e0:74:3a:8e:69:
-        5b:55
+        18:3d:23:29:a5:74:64:5d:c8:6d:b8:66:f6:68:d5:ff:72:51:
+        cb:ce:ca:6c:55:af:25:ff:c5:4e:ac:65:f3:16:a7:22:11:82:
+        4c:35:92:27:dc:23:55:a0:d8:b1:e9:1d:d7:fc:ba:a6:df:13:
+        c5:6c:85:42:43:cc:ec:ff:62:49:b1:ef:63:15:25:37:57:59:
+        15:e3:ab:26:06:5a:62:df:fb:82:1a:57:a0:0f:64:29:7f:80:
+        5e:e5:c7:2b:cb:5d:da:4d:e4:dc:da:52:94:79:9b:4b:b5:ba:
+        fa:4d:4b:65:26:95:20:70:95:8c:cf:d5:d2:fe:44:66:48:ec:
+        c1:ad
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAMDId7RMSU+rMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAPzA7pMTQxctMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG9w0BCQEWA3Rh
-NDAeFw0xMDA4MDQyMDU5MjhaFw0xMzA0MzAyMDU5MjhaMGgxCzAJBgNVBAYTAlVT
+NDAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG9w0BCQEWA3RhNDCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAn0Ya5QmYpr3Ptlwg/ILXhtLQlyDGEqVf
-bHosmmhMunUyCf7Vs1tq1PuVqr9aNsMuVz3R9IdMimYQiTnYuS8aPzf6BtDiXT8G
-i6RuhU9kj3IF+/6qB/WtsEnFNu6WwElYiPWiLzuQfbge17Bnzbk4BY2nlIxAMwsf
-fQPcmcFVSVkCAwEAAaOBzTCByjAdBgNVHQ4EFgQU/hRT75wLq+2WInARwuZ9LkC3
-f7UwgZoGA1UdIwSBkjCBj4AU/hRT75wLq+2WInARwuZ9LkC3f7WhbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwCvyE6Up6BntFbfvZSozvKojFwdP4rjC
+/OjwNtJxVf5FFU9iPQv2Gk5sfFkJBhBu9hcclk7Wzvq4tqQ2l5XcSYfO7RAa+Mq5
+jz7U5olkJwEd4FadcVV78VPrFrnWPPQ1P6Ujt1Ae2A1nr/tld1U0D6nPNZq86u3L
+fFyfYRqW6qMCAwEAAaOBzTCByjAdBgNVHQ4EFgQUuahSX5EbKiepCpRUBlIvcoaF
+nnUwgZoGA1UdIwSBkjCBj4AUuahSX5EbKiepCpRUBlIvcoaFnnWhbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG9w0BCQEW
-A3RhNIIJAMDId7RMSU+rMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-QrNmGlb9NKAskm3uP+DBwsaL4NXdMZvie5395LJxcv0yjVmhNupqRdWA1Hl1T/xQ
-NIzBWxUOOf1Amf03EvrSahq5Ztt8oFTg+uMDxkDPcU7k6cLL2zE6pwpclwp45VAD
-rG3j3wcRzXNadZWnQMBRKJvxphoc254bCuB0Oo5pW1U=
+A3RhNIIJAPzA7pMTQxctMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+GD0jKaV0ZF3Ibbhm9mjV/3JRy87KbFWvJf/FTqxl8xanIhGCTDWSJ9wjVaDYsekd
+1/y6pt8TxWyFQkPM7P9iSbHvYxUlN1dZFeOrJgZaYt/7ghpXoA9kKX+AXuXHK8td
+2k3k3NpSlHmbS7W6+k1LZSaVIHCVjM/V0v5EZkjswa0=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/ta5/ta5_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/ta5/ta5_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            cb:2a:36:97:17:4f:60:24
+            e0:a1:00:60:ae:57:96:b2
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta5/emailAddress=ta5
         Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
+            Not Before: Jan 28 02:54:25 2011 GMT
+            Not After : Oct 24 02:54:25 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta5/emailAddress=ta5
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:c0:be:12:dc:dd:d4:41:ab:8e:9c:fa:63:2c:b7:
-                    36:6a:7a:bb:71:4e:5e:7a:70:50:e6:37:b4:57:75:
-                    74:21:46:48:ee:2d:9b:42:a4:3f:4f:16:05:da:b7:
-                    73:4a:4c:ab:c1:64:b2:a8:9c:fe:b7:82:d3:ec:de:
-                    83:b0:f0:26:86:c0:da:39:ca:97:b0:ce:3c:6f:16:
-                    c3:07:26:47:2e:39:94:8f:a3:05:21:2c:c5:15:29:
-                    9b:98:23:12:77:38:b8:a9:0f:ae:69:c4:54:a2:dc:
-                    03:52:fe:99:28:2e:f0:fc:d1:a6:91:89:9b:b6:0c:
-                    c1:9b:48:e0:99:a5:42:e9:0b
+                    00:ab:ce:85:a0:8e:f0:46:60:75:e2:b8:90:39:ef:
+                    03:a8:47:a0:d7:75:a3:09:de:dd:a6:b2:ca:e1:3a:
+                    e1:fb:bb:59:36:43:85:e2:97:89:23:82:8e:6e:93:
+                    b5:76:aa:67:56:28:37:1a:8a:f3:4f:50:f7:59:50:
+                    3d:52:9d:b2:b3:28:36:b5:b1:c4:cf:92:56:d4:14:
+                    95:3d:c7:04:79:cd:88:ae:72:9e:9a:6f:49:7a:c2:
+                    a1:be:e5:38:c2:fc:62:ef:65:ab:20:7a:02:74:56:
+                    0d:09:8b:86:b2:6b:86:97:03:04:02:58:7c:01:12:
+                    1d:e4:27:0c:60:34:23:f7:35
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                AA:44:3A:A2:05:A2:04:EB:62:E0:E5:F5:2C:44:CA:3B:CF:4D:B2:74
+                62:0A:5F:1E:BA:AD:0B:1E:13:7A:CA:B4:5C:12:64:1F:BF:44:C6:B0
             X509v3 Authority Key Identifier: 
-                keyid:AA:44:3A:A2:05:A2:04:EB:62:E0:E5:F5:2C:44:CA:3B:CF:4D:B2:74
+                keyid:62:0A:5F:1E:BA:AD:0B:1E:13:7A:CA:B4:5C:12:64:1F:BF:44:C6:B0
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta5/emailAddress=ta5
-                serial:CB:2A:36:97:17:4F:60:24
+                serial:E0:A1:00:60:AE:57:96:B2
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        94:d5:b3:0f:11:c7:df:f9:f2:5a:a3:3c:66:f2:bd:8e:06:22:
-        d1:bb:f5:33:61:6d:8c:60:c3:4c:f8:b4:ab:1c:83:25:ca:49:
-        06:ab:de:23:24:f9:e1:b1:c1:41:4d:c8:19:74:8c:3e:01:17:
-        63:4d:c1:93:99:f1:ac:12:37:df:4e:68:8c:42:c3:51:2c:bf:
-        de:97:2f:2f:1b:58:c4:6e:35:6c:18:a4:f4:2e:21:2a:9a:bf:
-        dd:d8:90:f0:90:de:15:38:8f:c8:91:48:ce:3b:f5:29:c4:26:
-        94:a8:f9:21:7f:50:b3:ff:07:b8:88:1d:e5:68:1c:c1:31:40:
-        a8:0b
+        99:ed:98:00:f9:46:27:4d:de:ec:2f:4f:87:33:18:e6:25:e5:
+        45:ef:67:56:5d:24:42:b3:93:fd:3b:18:19:93:71:3c:24:88:
+        c2:84:6c:e6:91:a8:42:9a:a0:7d:3c:96:0f:50:89:2c:25:ad:
+        a0:d9:ee:d1:3c:37:da:75:17:6b:99:39:bc:5f:d4:82:7d:f0:
+        cf:d5:02:5a:e7:26:8c:47:c0:33:8d:1b:9e:70:d3:99:71:38:
+        1e:1e:05:54:aa:26:5b:f7:6d:4a:b5:e0:0c:db:e1:af:52:7e:
+        66:7c:5f:a5:4e:19:e4:77:9c:65:10:ad:cf:97:d6:78:26:fc:
+        1c:c2
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAMsqNpcXT2AkMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAOChAGCuV5ayMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTUxEjAQBgkqhkiG9w0BCQEWA3Rh
-NTAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMGgxCzAJBgNVBAYTAlVT
+NTAeFw0xMTAxMjgwMjU0MjVaFw0xMzEwMjQwMjU0MjVaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTUxEjAQBgkqhkiG9w0BCQEWA3RhNTCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwL4S3N3UQauOnPpjLLc2anq7cU5eenBQ
-5je0V3V0IUZI7i2bQqQ/TxYF2rdzSkyrwWSyqJz+t4LT7N6DsPAmhsDaOcqXsM48
-bxbDByZHLjmUj6MFISzFFSmbmCMSdzi4qQ+uacRUotwDUv6ZKC7w/NGmkYmbtgzB
-m0jgmaVC6QsCAwEAAaOBzTCByjAdBgNVHQ4EFgQUqkQ6ogWiBOti4OX1LETKO89N
-snQwgZoGA1UdIwSBkjCBj4AUqkQ6ogWiBOti4OX1LETKO89NsnShbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAq86FoI7wRmB14riQOe8DqEeg13WjCd7d
+prLK4Trh+7tZNkOF4peJI4KObpO1dqpnVig3GorzT1D3WVA9Up2ysyg2tbHEz5JW
+1BSVPccEec2IrnKemm9JesKhvuU4wvxi72WrIHoCdFYNCYuGsmuGlwMEAlh8ARId
+5CcMYDQj9zUCAwEAAaOBzTCByjAdBgNVHQ4EFgQUYgpfHrqtCx4Tesq0XBJkH79E
+xrAwgZoGA1UdIwSBkjCBj4AUYgpfHrqtCx4Tesq0XBJkH79ExrChbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTUxEjAQBgkqhkiG9w0BCQEW
-A3RhNYIJAMsqNpcXT2AkMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-lNWzDxHH3/nyWqM8ZvK9jgYi0bv1M2FtjGDDTPi0qxyDJcpJBqveIyT54bHBQU3I
-GXSMPgEXY03Bk5nxrBI3305ojELDUSy/3pcvLxtYxG41bBik9C4hKpq/3diQ8JDe
-FTiPyJFIzjv1KcQmlKj5IX9Qs/8HuIgd5WgcwTFAqAs=
+A3RhNYIJAOChAGCuV5ayMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+me2YAPlGJ03e7C9PhzMY5iXlRe9nVl0kQrOT/TsYGZNxPCSIwoRs5pGoQpqgfTyW
+D1CJLCWtoNnu0Tw32nUXa5k5vF/Ugn3wz9UCWucmjEfAM40bnnDTmXE4Hh4FVKom
+W/dtSrXgDNvhr1J+ZnxfpU4Z5HecZRCtz5fWeCb8HMI=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/trust_anchors/ta1_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/trust_anchors/ta1_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            cb:cf:1d:cd:f3:a6:cd:09
+            c1:e4:f1:a8:14:c7:a7:58
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta1/emailAddress=ta1
         Validity
-            Not Before: Aug  4 20:59:22 2010 GMT
-            Not After : Apr 30 20:59:22 2013 GMT
+            Not Before: Jan 28 02:54:10 2011 GMT
+            Not After : Oct 24 02:54:10 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta1/emailAddress=ta1
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:a7:64:67:53:f2:9a:c9:ce:a9:4a:92:16:57:61:
-                    c3:af:9d:0e:9f:61:82:ad:cf:7f:aa:59:f2:fa:06:
-                    3d:a2:ad:4f:db:90:3e:48:3e:00:d4:eb:96:c2:19:
-                    b3:e0:6a:f2:21:61:83:92:dd:86:50:ff:c6:3f:de:
-                    22:9c:1c:74:cb:09:06:e7:78:c2:8c:f8:98:2e:b5:
-                    e4:c2:f4:bf:b7:92:46:af:c7:d6:6c:59:07:d9:8c:
-                    06:96:1b:ef:10:dc:3e:f8:8b:08:9d:bd:81:3c:0d:
-                    a3:e9:55:5f:1b:04:39:b9:7f:f4:cf:d6:f9:a2:31:
-                    3a:83:96:21:92:a7:13:c4:4d
+                    00:a4:e5:50:4f:dd:85:ff:70:fd:e9:82:c0:b4:44:
+                    4e:3f:50:5e:32:57:52:9e:1d:ce:96:a4:36:38:5f:
+                    2c:c0:41:27:a7:4d:f4:04:d8:05:71:b3:56:a4:09:
+                    32:26:38:f8:17:a6:d7:e8:4c:f6:64:56:e0:fb:fa:
+                    6b:41:44:9c:06:fe:f1:99:35:d5:bb:66:8c:12:f6:
+                    ab:cd:90:02:df:94:97:5e:8c:94:89:8a:8f:2e:8b:
+                    8a:3c:0a:85:2f:9a:25:34:ad:b4:82:e4:04:4d:a8:
+                    8b:dc:b4:42:58:3d:c1:0f:85:28:d7:25:22:02:b8:
+                    09:f2:23:2e:57:eb:dd:e3:31
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                BB:C9:C7:62:4B:87:B7:6A:32:3F:A5:51:7B:C1:3A:8E:3F:06:5C:F7
+                15:AB:A2:AB:34:BD:EB:C4:C9:AE:0D:82:51:00:DD:2D:B1:1D:1A:7B
             X509v3 Authority Key Identifier: 
-                keyid:BB:C9:C7:62:4B:87:B7:6A:32:3F:A5:51:7B:C1:3A:8E:3F:06:5C:F7
+                keyid:15:AB:A2:AB:34:BD:EB:C4:C9:AE:0D:82:51:00:DD:2D:B1:1D:1A:7B
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta1/emailAddress=ta1
-                serial:CB:CF:1D:CD:F3:A6:CD:09
+                serial:C1:E4:F1:A8:14:C7:A7:58
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        07:cb:90:df:b3:18:22:61:79:1d:39:67:ee:3d:94:a8:7b:e1:
-        64:52:41:4a:1f:6e:14:34:b9:27:aa:05:77:f9:38:0c:66:20:
-        cf:92:0e:4e:94:bf:62:f1:2d:08:1c:ca:3e:77:5a:07:e9:35:
-        bb:a7:ca:31:8a:44:10:a9:56:f4:96:81:84:52:2c:36:45:ea:
-        72:46:6c:4a:ca:05:8c:79:d1:03:93:84:96:e4:fa:7b:5d:59:
-        21:9f:87:4d:ab:f1:64:e0:92:14:59:c6:c4:d8:3c:33:64:58:
-        98:96:83:f1:a6:26:fd:54:57:d7:f9:71:3c:83:d6:9b:ab:2a:
-        34:2f
+        4c:dc:c9:ca:75:c0:d1:87:da:b1:43:63:b9:41:2c:d1:05:78:
+        17:80:0a:63:8e:ea:a8:2a:8b:84:75:2a:ef:17:d1:5e:d9:78:
+        c5:4f:fb:b1:cb:16:93:fe:1b:b1:4f:4c:f2:b8:80:60:1a:34:
+        ff:d2:c3:99:6a:94:4a:00:4b:08:ea:b1:a6:1c:61:d1:8c:a3:
+        05:08:34:24:c7:6d:4a:7a:af:b0:1b:62:55:38:0d:fb:5e:ce:
+        4b:49:6f:c1:1b:0c:a6:7b:00:a8:e9:42:37:6b:1f:4c:4e:c6:
+        52:9c:cd:f0:86:39:68:b8:a4:51:e6:9a:4a:70:ef:60:e7:51:
+        7d:4a
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAMvPHc3zps0JMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAMHk8agUx6dYMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTExEjAQBgkqhkiG9w0BCQEWA3Rh
-MTAeFw0xMDA4MDQyMDU5MjJaFw0xMzA0MzAyMDU5MjJaMGgxCzAJBgNVBAYTAlVT
+MTAeFw0xMTAxMjgwMjU0MTBaFw0xMzEwMjQwMjU0MTBaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTExEjAQBgkqhkiG9w0BCQEWA3RhMTCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAp2RnU/Kayc6pSpIWV2HDr50On2GCrc9/
-qlny+gY9oq1P25A+SD4A1OuWwhmz4GryIWGDkt2GUP/GP94inBx0ywkG53jCjPiY
-LrXkwvS/t5JGr8fWbFkH2YwGlhvvENw++IsInb2BPA2j6VVfGwQ5uX/0z9b5ojE6
-g5YhkqcTxE0CAwEAAaOBzTCByjAdBgNVHQ4EFgQUu8nHYkuHt2oyP6VRe8E6jj8G
-XPcwgZoGA1UdIwSBkjCBj4AUu8nHYkuHt2oyP6VRe8E6jj8GXPehbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApOVQT92F/3D96YLAtEROP1BeMldSnh3O
+lqQ2OF8swEEnp030BNgFcbNWpAkyJjj4F6bX6Ez2ZFbg+/prQUScBv7xmTXVu2aM
+EvarzZAC35SXXoyUiYqPLouKPAqFL5olNK20guQETaiL3LRCWD3BD4Uo1yUiArgJ
+8iMuV+vd4zECAwEAAaOBzTCByjAdBgNVHQ4EFgQUFauiqzS968TJrg2CUQDdLbEd
+GnswgZoGA1UdIwSBkjCBj4AUFauiqzS968TJrg2CUQDdLbEdGnuhbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTExEjAQBgkqhkiG9w0BCQEW
-A3RhMYIJAMvPHc3zps0JMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-B8uQ37MYImF5HTln7j2UqHvhZFJBSh9uFDS5J6oFd/k4DGYgz5IOTpS/YvEtCBzK
-PndaB+k1u6fKMYpEEKlW9JaBhFIsNkXqckZsSsoFjHnRA5OEluT6e11ZIZ+HTavx
-ZOCSFFnGxNg8M2RYmJaD8aYm/VRX1/lxPIPWm6sqNC8=
+A3RhMYIJAMHk8agUx6dYMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+TNzJynXA0YfasUNjuUEs0QV4F4AKY47qqCqLhHUq7xfRXtl4xU/7scsWk/4bsU9M
+8riAYBo0/9LDmWqUSgBLCOqxphxh0YyjBQg0JMdtSnqvsBtiVTgN+17OS0lvwRsM
+pnsAqOlCN2sfTE7GUpzN8IY5aLikUeaaSnDvYOdRfUo=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/trust_anchors/ta2_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/trust_anchors/ta2_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            b0:ef:ff:7c:38:9b:09:88
+            a3:0a:29:bc:c4:1c:d8:4c
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta2/emailAddress=ta2
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta2/emailAddress=ta2
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:be:3e:9c:d8:84:82:5e:4b:9f:9c:0e:64:8c:9f:
-                    d0:84:d8:e4:ef:5e:0e:c2:83:94:e0:ef:6f:5a:91:
-                    3e:c5:b9:1b:cf:a5:8c:d8:39:7f:11:d3:51:1f:b7:
-                    7c:79:0e:0f:f4:0e:1d:34:49:70:cc:01:09:34:ff:
-                    cb:79:77:84:39:d9:bf:67:2c:e2:15:88:a7:9a:ec:
-                    ae:47:67:1a:72:fb:1d:be:60:26:3a:22:8e:b5:26:
-                    3d:04:c3:c6:23:87:4d:3c:34:58:5d:9a:f6:a1:a0:
-                    61:da:a6:c0:06:3e:c3:6b:db:f4:cb:7a:ef:f7:44:
-                    ef:b1:37:e3:86:31:70:fc:9b
+                    00:d6:3a:84:18:7a:d6:3a:ee:7d:4c:75:0a:18:f4:
+                    ce:c0:2c:b5:59:eb:bd:83:0c:3c:59:90:0c:35:b9:
+                    c8:55:a4:c1:04:88:41:c4:40:a8:73:4e:f1:e4:db:
+                    84:aa:bb:03:7b:e1:5e:5d:91:a0:ee:22:3d:f3:84:
+                    35:09:de:a9:07:69:35:e6:8f:65:c4:55:70:52:a6:
+                    5f:36:ff:6a:d3:7c:c5:6c:d3:cb:4f:a1:d8:94:68:
+                    14:49:32:93:4c:ad:ac:09:25:c5:b4:e5:92:c4:5d:
+                    f5:d0:49:54:dc:e6:df:80:6f:c2:86:34:39:0e:e6:
+                    a8:9b:6b:32:21:41:ca:7b:ad
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                F2:36:95:27:CB:21:43:55:A4:D6:1D:C0:D5:1C:39:64:1F:7B:59:28
+                D5:27:DA:4C:ED:2E:83:84:C3:2A:A9:98:E6:88:24:2A:03:01:CF:D5
             X509v3 Authority Key Identifier: 
-                keyid:F2:36:95:27:CB:21:43:55:A4:D6:1D:C0:D5:1C:39:64:1F:7B:59:28
+                keyid:D5:27:DA:4C:ED:2E:83:84:C3:2A:A9:98:E6:88:24:2A:03:01:CF:D5
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta2/emailAddress=ta2
-                serial:B0:EF:FF:7C:38:9B:09:88
+                serial:A3:0A:29:BC:C4:1C:D8:4C
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        2b:16:de:59:9f:d5:d6:88:9c:0c:10:8b:cd:9e:43:b6:d7:a8:
-        cc:4c:12:fb:88:b2:cd:99:f2:a9:d7:0d:2d:fc:48:26:bc:41:
-        09:58:14:a2:79:52:41:6d:94:4c:9b:ce:75:6d:14:4d:e8:43:
-        4a:7d:27:c9:e9:e0:76:2b:ca:4e:9b:af:12:34:83:0c:d5:15:
-        f6:a6:29:89:6e:56:49:ff:27:3c:08:bb:68:29:9e:77:09:f9:
-        1a:67:2a:f5:75:c7:f0:4b:1c:c3:6a:0e:06:50:04:e7:65:83:
-        f6:81:10:a3:4a:a5:96:ef:90:2f:ef:73:57:86:6d:10:ac:2a:
-        34:9d
+        23:44:91:7e:24:18:05:e5:1f:05:7b:e1:ca:e2:a5:b9:f0:16:
+        04:b2:2c:7d:1b:a7:7f:eb:9e:71:95:ab:8d:46:65:30:b5:3f:
+        af:e5:39:0e:2d:83:30:80:a0:cb:a7:f7:a4:41:5c:7e:d9:41:
+        ef:7b:d2:b6:dd:9e:37:d4:d4:ac:c7:ee:06:42:69:02:88:b2:
+        97:60:bc:95:c5:ca:c9:59:8a:d6:35:3f:b6:09:58:62:e7:c3:
+        a3:f9:f7:4e:10:30:94:05:91:0c:cb:f7:11:17:5e:7d:bf:99:
+        ca:1d:ca:08:58:f8:a0:ea:26:0e:44:ce:cc:4a:34:b8:6a:9e:
+        88:ac
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJALDv/3w4mwmIMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAKMKKbzEHNhMMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTIxEjAQBgkqhkiG9w0BCQEWA3Rh
-MjAeFw0xMDA4MDQyMDU5MjVaFw0xMzA0MzAyMDU5MjVaMGgxCzAJBgNVBAYTAlVT
+MjAeFw0xMTAxMjgwMjU0MTNaFw0xMzEwMjQwMjU0MTNaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTIxEjAQBgkqhkiG9w0BCQEWA3RhMjCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvj6c2ISCXkufnA5kjJ/QhNjk714OwoOU
-4O9vWpE+xbkbz6WM2Dl/EdNRH7d8eQ4P9A4dNElwzAEJNP/LeXeEOdm/ZyziFYin
-muyuR2cacvsdvmAmOiKOtSY9BMPGI4dNPDRYXZr2oaBh2qbABj7Da9v0y3rv90Tv
-sTfjhjFw/JsCAwEAAaOBzTCByjAdBgNVHQ4EFgQU8jaVJ8shQ1Wk1h3A1Rw5ZB97
-WSgwgZoGA1UdIwSBkjCBj4AU8jaVJ8shQ1Wk1h3A1Rw5ZB97WSihbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA1jqEGHrWOu59THUKGPTOwCy1Weu9gww8
+WZAMNbnIVaTBBIhBxECoc07x5NuEqrsDe+FeXZGg7iI984Q1Cd6pB2k15o9lxFVw
+UqZfNv9q03zFbNPLT6HYlGgUSTKTTK2sCSXFtOWSxF310ElU3ObfgG/ChjQ5Duao
+m2syIUHKe60CAwEAAaOBzTCByjAdBgNVHQ4EFgQU1SfaTO0ug4TDKqmY5ogkKgMB
+z9UwgZoGA1UdIwSBkjCBj4AU1SfaTO0ug4TDKqmY5ogkKgMBz9WhbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTIxEjAQBgkqhkiG9w0BCQEW
-A3RhMoIJALDv/3w4mwmIMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-KxbeWZ/V1oicDBCLzZ5DtteozEwS+4iyzZnyqdcNLfxIJrxBCVgUonlSQW2UTJvO
-dW0UTehDSn0nyengdivKTpuvEjSDDNUV9qYpiW5WSf8nPAi7aCmedwn5Gmcq9XXH
-8Escw2oOBlAE52WD9oEQo0qllu+QL+9zV4ZtEKwqNJ0=
+A3RhMoIJAKMKKbzEHNhMMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+I0SRfiQYBeUfBXvhyuKlufAWBLIsfRunf+uecZWrjUZlMLU/r+U5Di2DMICgy6f3
+pEFcftlB73vStt2eN9TUrMfuBkJpAoiyl2C8lcXKyVmK1jU/tglYYufDo/n3ThAw
+lAWRDMv3ERdefb+Zyh3KCFj4oOomDkTOzEo0uGqeiKw=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/trust_anchors/ta3_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/trust_anchors/ta3_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            e1:f8:52:2f:ac:f4:00:ee
+            98:29:8d:38:a1:e7:d1:02
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Validity
-            Not Before: Aug  4 20:59:25 2010 GMT
-            Not After : Apr 30 20:59:25 2013 GMT
+            Not Before: Jan 28 02:54:13 2011 GMT
+            Not After : Oct 24 02:54:13 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta3/emailAddress=ta3
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:cc:32:e7:d2:0d:be:82:1f:48:cb:d7:74:53:c9:
-                    7a:84:99:2a:d2:d0:01:ac:e2:26:a3:8c:02:ac:d8:
-                    51:13:31:1d:c6:4c:93:74:84:9d:e7:32:87:aa:88:
-                    db:ed:41:69:ee:5d:cd:71:bf:3b:c3:45:58:c2:c7:
-                    38:3e:e6:8e:a3:7e:d7:d0:57:fb:53:a9:c3:9d:51:
-                    6b:49:43:73:ea:69:18:9f:3a:f2:42:9c:3c:7b:13:
-                    21:f5:b8:b4:9c:58:fc:ea:a7:bd:3f:53:45:89:64:
-                    8d:56:13:3b:4e:26:d1:f9:ca:3a:8d:5e:73:ce:7f:
-                    0d:b1:8d:c2:e1:96:04:33:b1
+                    00:ee:7d:c2:8c:0e:23:2b:7d:b5:b9:51:ca:8f:45:
+                    37:2a:21:5b:2d:d6:ec:57:c5:fa:ac:f1:39:63:d3:
+                    6d:40:39:cc:53:23:a5:a5:72:6e:1a:f0:bc:e5:0b:
+                    fb:0d:82:40:b4:61:d7:a9:1b:b4:4a:55:62:cf:4e:
+                    3c:a6:39:65:fa:74:f9:91:8c:b9:0e:01:2b:cd:34:
+                    87:a7:76:f7:02:dd:ed:81:77:ca:d5:c7:9c:b8:03:
+                    a7:81:7e:c0:bf:14:32:7b:82:50:69:15:03:b0:7c:
+                    5d:66:d4:d1:58:70:0a:90:0c:97:b7:ab:64:30:45:
+                    5f:a8:7a:27:82:89:88:98:0d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
             X509v3 Authority Key Identifier: 
-                keyid:E0:CE:66:66:57:70:37:16:AF:EB:65:B6:15:DC:2D:2C:B7:B4:49:4D
+                keyid:DF:F1:C3:42:E4:27:21:E0:3B:1D:E0:85:47:1F:16:35:4D:58:F3:1E
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta3/emailAddress=ta3
-                serial:E1:F8:52:2F:AC:F4:00:EE
+                serial:98:29:8D:38:A1:E7:D1:02
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        b2:f7:78:f6:be:21:e5:91:f2:59:f5:9c:18:a8:3f:02:8b:39:
-        f0:80:84:ac:ed:12:70:83:2f:af:49:3a:6f:00:e8:15:e7:f4:
-        63:7a:53:08:3f:c1:66:bf:61:e9:a0:99:24:4b:93:62:e0:bd:
-        8a:ed:3f:4a:5a:09:6e:51:2e:53:67:f7:02:e0:4a:17:bb:d2:
-        a5:be:ab:e3:de:73:73:a3:ef:9d:ab:af:31:9b:bd:3c:01:9d:
-        08:14:83:44:07:59:86:96:92:59:fe:97:0c:37:9d:da:a1:af:
-        49:77:b4:72:a6:b7:8a:46:9f:ac:f3:db:ff:05:d8:15:4d:46:
-        fb:b5
+        b0:3d:ff:8a:38:de:32:30:4e:1f:f3:ba:2f:f9:4d:c4:20:31:
+        f9:5d:3e:38:91:c8:f9:ce:84:ed:3a:16:52:29:2c:4b:6c:5f:
+        f3:5d:76:c8:23:cb:be:8c:ba:26:f2:09:53:79:dd:67:28:aa:
+        f8:3a:19:ff:9a:47:d8:67:93:0a:fe:1d:ae:b4:71:2d:e8:52:
+        d9:78:1b:d9:5c:a0:8e:e9:ff:6a:f3:92:5c:5a:8f:12:3d:29:
+        35:c9:16:de:e7:94:6b:58:20:85:85:9e:31:d7:80:9a:e0:a8:
+        dc:e9:61:b0:4e:aa:7f:10:d4:90:e2:39:ca:b0:93:02:03:53:
+        89:6f
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAOH4Ui+s9ADuMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAJgpjTih59ECMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG9w0BCQEWA3Rh
-MzAeFw0xMDA4MDQyMDU5MjVaFw0xMzA0MzAyMDU5MjVaMGgxCzAJBgNVBAYTAlVT
+MzAeFw0xMTAxMjgwMjU0MTNaFw0xMzEwMjQwMjU0MTNaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG9w0BCQEWA3RhMzCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzDLn0g2+gh9Iy9d0U8l6hJkq0tABrOIm
-o4wCrNhREzEdxkyTdISd5zKHqojb7UFp7l3Ncb87w0VYwsc4PuaOo37X0Ff7U6nD
-nVFrSUNz6mkYnzryQpw8exMh9bi0nFj86qe9P1NFiWSNVhM7TibR+co6jV5zzn8N
-sY3C4ZYEM7ECAwEAAaOBzTCByjAdBgNVHQ4EFgQU4M5mZldwNxav62W2FdwtLLe0
-SU0wgZoGA1UdIwSBkjCBj4AU4M5mZldwNxav62W2FdwtLLe0SU2hbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA7n3CjA4jK321uVHKj0U3KiFbLdbsV8X6
+rPE5Y9NtQDnMUyOlpXJuGvC85Qv7DYJAtGHXqRu0SlViz048pjll+nT5kYy5DgEr
+zTSHp3b3At3tgXfK1cecuAOngX7AvxQye4JQaRUDsHxdZtTRWHAKkAyXt6tkMEVf
+qHongomImA0CAwEAAaOBzTCByjAdBgNVHQ4EFgQU3/HDQuQnIeA7HeCFRx8WNU1Y
+8x4wgZoGA1UdIwSBkjCBj4AU3/HDQuQnIeA7HeCFRx8WNU1Y8x6hbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTMxEjAQBgkqhkiG9w0BCQEW
-A3RhM4IJAOH4Ui+s9ADuMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-svd49r4h5ZHyWfWcGKg/Aos58ICErO0ScIMvr0k6bwDoFef0Y3pTCD/BZr9h6aCZ
-JEuTYuC9iu0/SloJblEuU2f3AuBKF7vSpb6r495zc6PvnauvMZu9PAGdCBSDRAdZ
-hpaSWf6XDDed2qGvSXe0cqa3ikafrPPb/wXYFU1G+7U=
+A3RhM4IJAJgpjTih59ECMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+sD3/ijjeMjBOH/O6L/lNxCAx+V0+OJHI+c6E7ToWUiksS2xf8112yCPLvoy6JvIJ
+U3ndZyiq+DoZ/5pH2GeTCv4drrRxLehS2Xgb2Vygjun/avOSXFqPEj0pNckW3ueU
+a1gghYWeMdeAmuCo3OlhsE6qfxDUkOI5yrCTAgNTiW8=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/trust_anchors/ta4_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/trust_anchors/ta4_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            c0:c8:77:b4:4c:49:4f:ab
+            fc:c0:ee:93:13:43:17:2d
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
         Validity
-            Not Before: Aug  4 20:59:28 2010 GMT
-            Not After : Apr 30 20:59:28 2013 GMT
+            Not Before: Jan 28 02:54:21 2011 GMT
+            Not After : Oct 24 02:54:21 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta4/emailAddress=ta4
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:9f:46:1a:e5:09:98:a6:bd:cf:b6:5c:20:fc:82:
-                    d7:86:d2:d0:97:20:c6:12:a5:5f:6c:7a:2c:9a:68:
-                    4c:ba:75:32:09:fe:d5:b3:5b:6a:d4:fb:95:aa:bf:
-                    5a:36:c3:2e:57:3d:d1:f4:87:4c:8a:66:10:89:39:
-                    d8:b9:2f:1a:3f:37:fa:06:d0:e2:5d:3f:06:8b:a4:
-                    6e:85:4f:64:8f:72:05:fb:fe:aa:07:f5:ad:b0:49:
-                    c5:36:ee:96:c0:49:58:88:f5:a2:2f:3b:90:7d:b8:
-                    1e:d7:b0:67:cd:b9:38:05:8d:a7:94:8c:40:33:0b:
-                    1f:7d:03:dc:99:c1:55:49:59
+                    00:c0:2b:f2:13:a5:29:e8:19:ed:15:b7:ef:65:2a:
+                    33:bc:aa:23:17:07:4f:e2:b8:c2:fc:e8:f0:36:d2:
+                    71:55:fe:45:15:4f:62:3d:0b:f6:1a:4e:6c:7c:59:
+                    09:06:10:6e:f6:17:1c:96:4e:d6:ce:fa:b8:b6:a4:
+                    36:97:95:dc:49:87:ce:ed:10:1a:f8:ca:b9:8f:3e:
+                    d4:e6:89:64:27:01:1d:e0:56:9d:71:55:7b:f1:53:
+                    eb:16:b9:d6:3c:f4:35:3f:a5:23:b7:50:1e:d8:0d:
+                    67:af:fb:65:77:55:34:0f:a9:cf:35:9a:bc:ea:ed:
+                    cb:7c:5c:9f:61:1a:96:ea:a3
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                FE:14:53:EF:9C:0B:AB:ED:96:22:70:11:C2:E6:7D:2E:40:B7:7F:B5
+                B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
             X509v3 Authority Key Identifier: 
-                keyid:FE:14:53:EF:9C:0B:AB:ED:96:22:70:11:C2:E6:7D:2E:40:B7:7F:B5
+                keyid:B9:A8:52:5F:91:1B:2A:27:A9:0A:94:54:06:52:2F:72:86:85:9E:75
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta4/emailAddress=ta4
-                serial:C0:C8:77:B4:4C:49:4F:AB
+                serial:FC:C0:EE:93:13:43:17:2D
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        42:b3:66:1a:56:fd:34:a0:2c:92:6d:ee:3f:e0:c1:c2:c6:8b:
-        e0:d5:dd:31:9b:e2:7b:9d:fd:e4:b2:71:72:fd:32:8d:59:a1:
-        36:ea:6a:45:d5:80:d4:79:75:4f:fc:50:34:8c:c1:5b:15:0e:
-        39:fd:40:99:fd:37:12:fa:d2:6a:1a:b9:66:db:7c:a0:54:e0:
-        fa:e3:03:c6:40:cf:71:4e:e4:e9:c2:cb:db:31:3a:a7:0a:5c:
-        97:0a:78:e5:50:03:ac:6d:e3:df:07:11:cd:73:5a:75:95:a7:
-        40:c0:51:28:9b:f1:a6:1a:1c:db:9e:1b:0a:e0:74:3a:8e:69:
-        5b:55
+        18:3d:23:29:a5:74:64:5d:c8:6d:b8:66:f6:68:d5:ff:72:51:
+        cb:ce:ca:6c:55:af:25:ff:c5:4e:ac:65:f3:16:a7:22:11:82:
+        4c:35:92:27:dc:23:55:a0:d8:b1:e9:1d:d7:fc:ba:a6:df:13:
+        c5:6c:85:42:43:cc:ec:ff:62:49:b1:ef:63:15:25:37:57:59:
+        15:e3:ab:26:06:5a:62:df:fb:82:1a:57:a0:0f:64:29:7f:80:
+        5e:e5:c7:2b:cb:5d:da:4d:e4:dc:da:52:94:79:9b:4b:b5:ba:
+        fa:4d:4b:65:26:95:20:70:95:8c:cf:d5:d2:fe:44:66:48:ec:
+        c1:ad
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAMDId7RMSU+rMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAPzA7pMTQxctMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG9w0BCQEWA3Rh
-NDAeFw0xMDA4MDQyMDU5MjhaFw0xMzA0MzAyMDU5MjhaMGgxCzAJBgNVBAYTAlVT
+NDAeFw0xMTAxMjgwMjU0MjFaFw0xMzEwMjQwMjU0MjFaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG9w0BCQEWA3RhNDCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAn0Ya5QmYpr3Ptlwg/ILXhtLQlyDGEqVf
-bHosmmhMunUyCf7Vs1tq1PuVqr9aNsMuVz3R9IdMimYQiTnYuS8aPzf6BtDiXT8G
-i6RuhU9kj3IF+/6qB/WtsEnFNu6WwElYiPWiLzuQfbge17Bnzbk4BY2nlIxAMwsf
-fQPcmcFVSVkCAwEAAaOBzTCByjAdBgNVHQ4EFgQU/hRT75wLq+2WInARwuZ9LkC3
-f7UwgZoGA1UdIwSBkjCBj4AU/hRT75wLq+2WInARwuZ9LkC3f7WhbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwCvyE6Up6BntFbfvZSozvKojFwdP4rjC
+/OjwNtJxVf5FFU9iPQv2Gk5sfFkJBhBu9hcclk7Wzvq4tqQ2l5XcSYfO7RAa+Mq5
+jz7U5olkJwEd4FadcVV78VPrFrnWPPQ1P6Ujt1Ae2A1nr/tld1U0D6nPNZq86u3L
+fFyfYRqW6qMCAwEAAaOBzTCByjAdBgNVHQ4EFgQUuahSX5EbKiepCpRUBlIvcoaF
+nnUwgZoGA1UdIwSBkjCBj4AUuahSX5EbKiepCpRUBlIvcoaFnnWhbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTQxEjAQBgkqhkiG9w0BCQEW
-A3RhNIIJAMDId7RMSU+rMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-QrNmGlb9NKAskm3uP+DBwsaL4NXdMZvie5395LJxcv0yjVmhNupqRdWA1Hl1T/xQ
-NIzBWxUOOf1Amf03EvrSahq5Ztt8oFTg+uMDxkDPcU7k6cLL2zE6pwpclwp45VAD
-rG3j3wcRzXNadZWnQMBRKJvxphoc254bCuB0Oo5pW1U=
+A3RhNIIJAPzA7pMTQxctMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+GD0jKaV0ZF3Ibbhm9mjV/3JRy87KbFWvJf/FTqxl8xanIhGCTDWSJ9wjVaDYsekd
+1/y6pt8TxWyFQkPM7P9iSbHvYxUlN1dZFeOrJgZaYt/7ghpXoA9kKX+AXuXHK8td
+2k3k3NpSlHmbS7W6+k1LZSaVIHCVjM/V0v5EZkjswa0=
 -----END CERTIFICATE-----
--- a/src/tests/ro_data/signing_certs/produced/trust_anchors/ta5_cert.pem	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/tests/ro_data/signing_certs/produced/trust_anchors/ta5_cert.pem	Tue Feb 08 23:55:15 2011 -0800
@@ -2,62 +2,62 @@
     Data:
         Version: 3 (0x2)
         Serial Number:
-            cb:2a:36:97:17:4f:60:24
+            e0:a1:00:60:ae:57:96:b2
         Signature Algorithm: sha256WithRSAEncryption
         Issuer: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta5/emailAddress=ta5
         Validity
-            Not Before: Aug  4 20:59:29 2010 GMT
-            Not After : Apr 30 20:59:29 2013 GMT
+            Not Before: Jan 28 02:54:25 2011 GMT
+            Not After : Oct 24 02:54:25 2013 GMT
         Subject: C=US, ST=California, L=Menlo Park, O=pkg5, CN=ta5/emailAddress=ta5
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
             RSA Public Key: (1024 bit)
                 Modulus (1024 bit):
-                    00:c0:be:12:dc:dd:d4:41:ab:8e:9c:fa:63:2c:b7:
-                    36:6a:7a:bb:71:4e:5e:7a:70:50:e6:37:b4:57:75:
-                    74:21:46:48:ee:2d:9b:42:a4:3f:4f:16:05:da:b7:
-                    73:4a:4c:ab:c1:64:b2:a8:9c:fe:b7:82:d3:ec:de:
-                    83:b0:f0:26:86:c0:da:39:ca:97:b0:ce:3c:6f:16:
-                    c3:07:26:47:2e:39:94:8f:a3:05:21:2c:c5:15:29:
-                    9b:98:23:12:77:38:b8:a9:0f:ae:69:c4:54:a2:dc:
-                    03:52:fe:99:28:2e:f0:fc:d1:a6:91:89:9b:b6:0c:
-                    c1:9b:48:e0:99:a5:42:e9:0b
+                    00:ab:ce:85:a0:8e:f0:46:60:75:e2:b8:90:39:ef:
+                    03:a8:47:a0:d7:75:a3:09:de:dd:a6:b2:ca:e1:3a:
+                    e1:fb:bb:59:36:43:85:e2:97:89:23:82:8e:6e:93:
+                    b5:76:aa:67:56:28:37:1a:8a:f3:4f:50:f7:59:50:
+                    3d:52:9d:b2:b3:28:36:b5:b1:c4:cf:92:56:d4:14:
+                    95:3d:c7:04:79:cd:88:ae:72:9e:9a:6f:49:7a:c2:
+                    a1:be:e5:38:c2:fc:62:ef:65:ab:20:7a:02:74:56:
+                    0d:09:8b:86:b2:6b:86:97:03:04:02:58:7c:01:12:
+                    1d:e4:27:0c:60:34:23:f7:35
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                AA:44:3A:A2:05:A2:04:EB:62:E0:E5:F5:2C:44:CA:3B:CF:4D:B2:74
+                62:0A:5F:1E:BA:AD:0B:1E:13:7A:CA:B4:5C:12:64:1F:BF:44:C6:B0
             X509v3 Authority Key Identifier: 
-                keyid:AA:44:3A:A2:05:A2:04:EB:62:E0:E5:F5:2C:44:CA:3B:CF:4D:B2:74
+                keyid:62:0A:5F:1E:BA:AD:0B:1E:13:7A:CA:B4:5C:12:64:1F:BF:44:C6:B0
                 DirName:/C=US/ST=California/L=Menlo Park/O=pkg5/CN=ta5/emailAddress=ta5
-                serial:CB:2A:36:97:17:4F:60:24
+                serial:E0:A1:00:60:AE:57:96:B2
 
             X509v3 Basic Constraints: 
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-        94:d5:b3:0f:11:c7:df:f9:f2:5a:a3:3c:66:f2:bd:8e:06:22:
-        d1:bb:f5:33:61:6d:8c:60:c3:4c:f8:b4:ab:1c:83:25:ca:49:
-        06:ab:de:23:24:f9:e1:b1:c1:41:4d:c8:19:74:8c:3e:01:17:
-        63:4d:c1:93:99:f1:ac:12:37:df:4e:68:8c:42:c3:51:2c:bf:
-        de:97:2f:2f:1b:58:c4:6e:35:6c:18:a4:f4:2e:21:2a:9a:bf:
-        dd:d8:90:f0:90:de:15:38:8f:c8:91:48:ce:3b:f5:29:c4:26:
-        94:a8:f9:21:7f:50:b3:ff:07:b8:88:1d:e5:68:1c:c1:31:40:
-        a8:0b
+        99:ed:98:00:f9:46:27:4d:de:ec:2f:4f:87:33:18:e6:25:e5:
+        45:ef:67:56:5d:24:42:b3:93:fd:3b:18:19:93:71:3c:24:88:
+        c2:84:6c:e6:91:a8:42:9a:a0:7d:3c:96:0f:50:89:2c:25:ad:
+        a0:d9:ee:d1:3c:37:da:75:17:6b:99:39:bc:5f:d4:82:7d:f0:
+        cf:d5:02:5a:e7:26:8c:47:c0:33:8d:1b:9e:70:d3:99:71:38:
+        1e:1e:05:54:aa:26:5b:f7:6d:4a:b5:e0:0c:db:e1:af:52:7e:
+        66:7c:5f:a5:4e:19:e4:77:9c:65:10:ad:cf:97:d6:78:26:fc:
+        1c:c2
 -----BEGIN CERTIFICATE-----
-MIIDHDCCAoWgAwIBAgIJAMsqNpcXT2AkMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
+MIIDHDCCAoWgAwIBAgIJAOChAGCuV5ayMA0GCSqGSIb3DQEBCwUAMGgxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJr
 MQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTUxEjAQBgkqhkiG9w0BCQEWA3Rh
-NTAeFw0xMDA4MDQyMDU5MjlaFw0xMzA0MzAyMDU5MjlaMGgxCzAJBgNVBAYTAlVT
+NTAeFw0xMTAxMjgwMjU0MjVaFw0xMzEwMjQwMjU0MjVaMGgxCzAJBgNVBAYTAlVT
 MRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQYXJrMQ0wCwYD
 VQQKEwRwa2c1MQwwCgYDVQQDEwN0YTUxEjAQBgkqhkiG9w0BCQEWA3RhNTCBnzAN
-BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwL4S3N3UQauOnPpjLLc2anq7cU5eenBQ
-5je0V3V0IUZI7i2bQqQ/TxYF2rdzSkyrwWSyqJz+t4LT7N6DsPAmhsDaOcqXsM48
-bxbDByZHLjmUj6MFISzFFSmbmCMSdzi4qQ+uacRUotwDUv6ZKC7w/NGmkYmbtgzB
-m0jgmaVC6QsCAwEAAaOBzTCByjAdBgNVHQ4EFgQUqkQ6ogWiBOti4OX1LETKO89N
-snQwgZoGA1UdIwSBkjCBj4AUqkQ6ogWiBOti4OX1LETKO89NsnShbKRqMGgxCzAJ
+BgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAq86FoI7wRmB14riQOe8DqEeg13WjCd7d
+prLK4Trh+7tZNkOF4peJI4KObpO1dqpnVig3GorzT1D3WVA9Up2ysyg2tbHEz5JW
+1BSVPccEec2IrnKemm9JesKhvuU4wvxi72WrIHoCdFYNCYuGsmuGlwMEAlh8ARId
+5CcMYDQj9zUCAwEAAaOBzTCByjAdBgNVHQ4EFgQUYgpfHrqtCx4Tesq0XBJkH79E
+xrAwgZoGA1UdIwSBkjCBj4AUYgpfHrqtCx4Tesq0XBJkH79ExrChbKRqMGgxCzAJ
 BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQHEwpNZW5sbyBQ
 YXJrMQ0wCwYDVQQKEwRwa2c1MQwwCgYDVQQDEwN0YTUxEjAQBgkqhkiG9w0BCQEW
-A3RhNYIJAMsqNpcXT2AkMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
-lNWzDxHH3/nyWqM8ZvK9jgYi0bv1M2FtjGDDTPi0qxyDJcpJBqveIyT54bHBQU3I
-GXSMPgEXY03Bk5nxrBI3305ojELDUSy/3pcvLxtYxG41bBik9C4hKpq/3diQ8JDe
-FTiPyJFIzjv1KcQmlKj5IX9Qs/8HuIgd5WgcwTFAqAs=
+A3RhNYIJAOChAGCuV5ayMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADgYEA
+me2YAPlGJ03e7C9PhzMY5iXlRe9nVl0kQrOT/TsYGZNxPCSIwoRs5pGoQpqgfTyW
+D1CJLCWtoNnu0Tw32nUXa5k5vF/Ugn3wz9UCWucmjEfAM40bnnDTmXE4Hh4FVKom
+W/dtSrXgDNvhr1J+ZnxfpU4Z5HecZRCtz5fWeCb8HMI=
 -----END CERTIFICATE-----
--- a/src/util/distro-import/importer.py	Tue Feb 08 18:59:49 2011 -0800
+++ b/src/util/distro-import/importer.py	Tue Feb 08 23:55:15 2011 -0800
@@ -56,7 +56,7 @@
 from pkg.misc import emsg
 from pkg.portable import PD_LOCAL_PATH, PD_PROTO_DIR, PD_PROTO_DIR_LIST
 
-CLIENT_API_VERSION = 49
+CLIENT_API_VERSION = 52
 PKG_CLIENT_NAME = "importer.py"
 pkg.client.global_settings.client_name = PKG_CLIENT_NAME