Hi all, Removed some interfaces that will not be used as per Jack's mention. Also added some controller objects to handle TKS operations (courtesy of Jack) And added some flows on page 2, so that we can see how the new interface would all work together. I took a quick stab at the key archival/ recovery scenarios - but that probably needs more massaging from more experienced PKI folks. Adam, please wikify. Ade