ACK

One minor issue:

The explaining text in the CS.cfg is incorrect. It has the meaning
of the new flag reverse to what is intended:

When recovering by keyid: externalReg.recover.byKeyID=false
+externalReg._024=#       - keyid in record indicates actual recovery;
+externalReg._025=#         e.g. (certstoadd: 36,ca1,5,kra1)
+externalReg._026=#       - missing of which means retention;
+externalReg._027=#         e.g. (certstoadd: 36,ca1)
+externalReg._028=#     When recovering by cert: externalReg.recover.byKeyID=true
+externalReg._029=#       - keyid field needs to be present
+externalReg._030=#         but the value is not relevant and will be ignored
+externalReg._031=#         (a "0" would be fine)
+externalReg._032=#         e.g. (certstoadd: 36,ca1,0,kra1)
+externalReg._033=#       - missing of keyid still means retention;
+externalReg._034=#         e.g. (certstoadd: 36,ca1)

false and true for byKeID is switched.

Also, since there is a small chance of impact to certain external reg features, such as retention,
it might make sense to recommend a quick sanity test of the external reg feature after this.

In the future we might want to more strongly discourage the keyid pathway.

----- Original Message -----