Looks good as is: Some minor suggestions.. 1. The following line: For all PKI subsystems, ECC is not supported for the corresponding Audit Signing parameters. Might be a bit cleare to insert "including the CA", since the first part of the page talks about the CA and the second half discusses exceptions for other subystems, thus the user may assume. 2. It might be nice optionally to include a KRA sample if feasible. ACK with one semi required and 2 optional. ----- Original Message -----