From 862d1daf031e989ed4337c44d387b761d624677a Mon Sep 17 00:00:00 2001
From: Randy Bush <randy@psg.com>
Date: Mon, 25 Sep 2023 06:55:45 -0700
Subject: [PATCH] remove Error: Spurious zero bits in bitstring.

---
 draft-ietf-opsawg-9092-update.xml | 731 +++++++++++++++---------------
 1 file changed, 364 insertions(+), 367 deletions(-)

diff --git a/draft-ietf-opsawg-9092-update.xml b/draft-ietf-opsawg-9092-update.xml
index 7634589..cc27243 100644
--- a/draft-ietf-opsawg-9092-update.xml
+++ b/draft-ietf-opsawg-9092-update.xml
@@ -8,7 +8,7 @@
 <?rfc compact="yes"?>
 <?rfc subcompact="no"?>
 
-<rfc category="std" docName="draft-ietf-opsawg-9092-update-03"
+<rfc category="std" docName="draft-ietf-opsawg-9092-update-04"
      submissionType="IETF" consensus="true" ipr="trust200902"
      obsoletes="9092" version="2" >
 
@@ -940,62 +940,60 @@
     
 
     <section title="Example" anchor="example">
-
       <t>
-        This appendix provides an example, including a trust anchor, a
-        CRL signed by the trust anchor, a CA certificate subordinate to
-        the trust anchor, a CRL signed by the CA, an end-entity
-        certificate subordinate to the CA for signing the geofeed, and a
-        detached signature.</t>
+   This appendix provides an example, including a trust anchor, 
+   a CRL signed by the trust anchor, a CA certificate subordinate to
+   the trust anchor, a CRL signed by the CA, an end-entity certificate
+   subordinate to the CA for signing the geofeed, and a detached signature.</t>
 
-     <t>
-       The trust anchor is represented by a self-signed certificate.  As
-       usual in the RPKI, the trust anchor has authority over all IPv4
-       address blocks, all IPv6 address blocks, and all AS numbers.</t>
+   <t>
+   The trust anchor is represented by a self-signed certificate.  As usual in
+   the RPKI, the trust anchor has authority over all IPv4 address blocks,
+   all IPv6 address blocks, and all AS numbers.</t>
 
-    <figure><artwork><![CDATA[
------BEGIN CERTIFICATE-----
-MIIEPjCCAyagAwIBAgIUPsUFJ4e/7pKZ6E14aBdkbYzms1gwDQYJKoZIhvcNAQEL
-BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yMDA5MDMxODU0NTRaFw0zMDA5
-MDExODU0NTRaMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEwggEiMA0GCSqGSIb3DQEB
-AQUAA4IBDwAwggEKAoIBAQCelMmMDCGBhqn/a3VrNAoKMr1HVLKxGoG7VF/13HZJ
-0twObUZlh3Jz+XeD+kNAURhELWTrsgdTkQQfqinqOuRemxTl55+x7nLpe5nmwaBH
-XqqDOHubmkbAGanGcm6T/rD9KNk1Z46Uc2p7UYu0fwNO0mo0aqFL2FSyvzZwziNe
-g7ELYZ4a3LvGn81JfP/JvM6pgtoMNuee5RV6TWaz7LV304ICj8Bhphy/HFpOA1rb
-O9gs8CUMgqz+RroAIa8cV8gbF/fPCz9Ofl7Gdmib679JxxFrW4wRJ0nMJgJmsZXq
-jaVc0g7ORc+eIAcHw7Uroc6h7Y7lGjOkDZF75j0mLQa3AgMBAAGjggGEMIIBgDAd
-BgNVHQ4EFgQU3hNEuwvUGNCHY1TBatcUR03pNdYwHwYDVR0jBBgwFoAU3hNEuwvU
-GNCHY1TBatcUR03pNdYwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
-GAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjCBuQYIKwYBBQUHAQsEgawwgakwPgYI
-KwYBBQUHMAqGMnJzeW5jOi8vcnBraS5leGFtcGxlLm5ldC9yZXBvc2l0b3J5L2V4
-YW1wbGUtdGEubWZ0MDUGCCsGAQUFBzANhilodHRwczovL3JyZHAuZXhhbXBsZS5u
-ZXQvbm90aWZpY2F0aW9uLnhtbDAwBggrBgEFBQcwBYYkcnN5bmM6Ly9ycGtpLmV4
-YW1wbGUubmV0L3JlcG9zaXRvcnkvMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATAD
-AwEAMAkEAgACMAMDAQAwHgYIKwYBBQUHAQgEEjAQoA4wDDAKAgEAAgUA/////zAN
-BgkqhkiG9w0BAQsFAAOCAQEAgZFQ0Sf3CI5Hwev61AUWHYOFniy69PuDTq+WnhDe
-xX5rpjSDRrs5L756KSKJcaOJ36lzO45lfOPSY9fH6x30pnipaqRA7t5rApky24jH
-cSUA9iRednzxhVyGjWKnfAKyNo2MYfaOAT0db1GjyLKbOADI9FowtHBUu+60ykcM
-Quz66XrzxtmxlrRcAnbv/HtV17qOd4my6q5yjTPR1dmYN9oR/2ChlXtGE6uQVguA
-rvNZ5CwiJ1TgGGTB7T8ORHwWU6dGTc0jk2rESAaikmLi1roZSNC21fckhapEit1a
-x8CyiVxjcVc5e0AmS1rJfL6LIfwmtive/N/eBtIM92HkBA==
------END CERTIFICATE-----
+   <figure><artwork><![CDATA[
+   -----BEGIN CERTIFICATE-----
+   MIIEQTCCAymgAwIBAgIUEggycNoFVRjAuN/Fw7URu0DEZNAwDQYJKoZIhvcNAQEL
+   BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yMzA5MTkyMDMzMzlaFw0zMzA5
+   MTYyMDMzMzlaMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEwggEiMA0GCSqGSIb3DQEB
+   AQUAA4IBDwAwggEKAoIBAQDQprR+g/i4JyObVURTp1JpGM23vGPyE5fDKFPqV7rw
+   M1Amm7cnew66U02IzV0X5oiv5nSGfRX5UxsbR+vwPBMceQyDgS5lexFiv4fB/Vjf
+   DT2qX/UjsLL9QOeaSOh7ToJSLjmtpa0D9iz7ful3hdxRjpMMZiE/reX9/ymdpW/E
+   dg0F6+T9WGZE1miPeIjl5OZwnmLHCftkN/aaYk1iPNjNniHYIOjC1jSpABmoZyTj
+   sgrwLE2F1fIRkVkwASqToq/D5v9voXaYYaXUNJb4H/5wenRuvT5O/n6PXh70rMQy
+   F5yzLs96ytxqg5gGX9kabVnvxFU8nHfPa0rhlwfTJnljAgMBAAGjggGHMIIBgzAd
+   BgNVHQ4EFgQUwL1SXb7SeLIW7LOjQ5XSBguZCDIwHwYDVR0jBBgwFoAUwL1SXb7S
+   eLIW7LOjQ5XSBguZCDIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
+   GAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjCBuQYIKwYBBQUHAQsEgawwgakwPgYI
+   KwYBBQUHMAqGMnJzeW5jOi8vcnBraS5leGFtcGxlLm5ldC9yZXBvc2l0b3J5L2V4
+   YW1wbGUtdGEubWZ0MDUGCCsGAQUFBzANhilodHRwczovL3JyZHAuZXhhbXBsZS5u
+   ZXQvbm90aWZpY2F0aW9uLnhtbDAwBggrBgEFBQcwBYYkcnN5bmM6Ly9ycGtpLmV4
+   YW1wbGUubmV0L3JlcG9zaXRvcnkvMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATAD
+   AwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAKAgEAAgUA////
+   /zANBgkqhkiG9w0BAQsFAAOCAQEAa9eLY9QAmnlZOIyOzbpta5wqcOUQV/yR7o/0
+   1zkEZaSavKBt19lMK6AXZurx1T5jyjIwG7bEtZZThjtH2m80V5kc2tsFjSq/yp7N
+   JBclMHVd3tXse9If3nXYF4bxRIcir1lXlAbYN+Eo1U3i5qJO+fxouzt7Merk2Dih
+   nsenTeXKzN7tfmuCYZZHCC8viCoJWdH+o1uRM4TiQApZsUJ8sF4TABrrRJmA/Ed5
+   v0CTBbgqTx7yg0+VarFLPdnjYgtpoCJqwE2C1UpX15rZSaLVuGXtbwXd/cHEg5vF
+   W6QTsMeMQFEUa6hkicDGtxLTUdhckBgmCGoF2nlZii5f1BTWAg==
+   -----END CERTIFICATE-----
 ]]></artwork></figure>
 
    <t>
    The CRL issued by the trust anchor.</t>
 
-    <figure><artwork><![CDATA[
-    -----BEGIN X509 CRL-----
-    MIIBjjB4AgEBMA0GCSqGSIb3DQEBCwUAMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEX
-    DTIzMDkyMDE4MDkxMVoXDTIzMTAyMDE4MDkxMVqgLzAtMB8GA1UdIwQYMBaAFMC9
-    Ul2+0niyFuyzo0OV0gYLmQgyMAoGA1UdFAQDAgEBMA0GCSqGSIb3DQEBCwUAA4IB
-    AQALdNwYgIPHVauhT9yGV2Oj28aj6yI8X/xQz53Gh7zqz4AfKSA3rmFUiQiPnLiA
-    oO+oI83tzoTwxwVRdGpzc8ZhZ5yCwAQYZdiGteagLFi1zghWbRNWH/m7q/ypw1xd
-    GZs3ow6b29OMr9ue/5s++bWMQ6oHh24cVB5S9kX3v7N0OeE0/SGcKtaeT+WE5SWC
-    hudIB52s5NPcKu1SEnn/D8JLGoadxatmFEGMfRX2Wo9dcntcyCr/MPl6ZhvM9tsF
-    Oxoom7RRnAfz+AWwptYrCkvKFdk974UCe9Bq2Bq3xuhrLs1kT6+yy0U9y7hyJYK/
-    Dq9IJ9RuBsQagykwbwLbzlTr
-    -----END X509 CRL-----
+   <figure><artwork><![CDATA[
+   -----BEGIN X509 CRL-----
+   MIIBjjB4AgEBMA0GCSqGSIb3DQEBCwUAMBUxEzARBgNVBAMTCmV4YW1wbGUtdGEX
+   DTIzMDkyMzE1NTUzOFoXDTIzMTAyMzE1NTUzOFqgLzAtMB8GA1UdIwQYMBaAFMC9
+   Ul2+0niyFuyzo0OV0gYLmQgyMAoGA1UdFAQDAgEEMA0GCSqGSIb3DQEBCwUAA4IB
+   AQCngOu+Nq3WC4y/pHtLoheAOtNg32WWsKPNiEyL+QalmOtURUsWMzOq41bmoPzQ
+   NDQoRmXe9mvohAVRe0CnM7A07HOtSfjw5aoouPXGTtfwEomHG2CYk+2U1bvxgZyA
+   E1c5TvyhkabFMO0+857wqxRP+ht9NV0lMX6kUFlEOCw3ELVd9oNNRBwKQtXj1huM
+   6Sf26va2a1tnC5zP01hN+EY3S9T5T1gcgPGBcqRWKoXJEbRzCrLsb/TMj5cMpIje
+   AHZoBojVAmvL1AIH/BnGAQj0+XqaJ0axHvlqJa8iX8QwKqhp+o6sv/atY2QDDRmE
+   Yjq/VrBVKu5VsDY2Lr29HszA
+   -----END X509 CRL-----
 ]]></artwork></figure>
 
    <t>
@@ -1003,54 +1001,54 @@ x8CyiVxjcVc5e0AmS1rJfL6LIfwmtive/N/eBtIM92HkBA==
    certificate grants authority over one IPv4 address block
    (192.0.2.0/24) and two AS numbers (64496 and 64497).</t>
 
-<figure><artwork><![CDATA[
------BEGIN CERTIFICATE-----
-MIIFCjCCA/KgAwIBAgIUcyCzS10hdfG65kbRq7toQAvRDLYwDQYJKoZIhvcNAQEL
-BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yMzA5MjAxNjQ5MjhaFw0yNDA5
-MTkxNjQ5MjhaMDMxMTAvBgNVBAMTKDNBQ0UyQ0VGNEZCMjFCN0QxMUUzRTE4NEVG
-QzFFMjk3QjM3Nzg2NDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc
-zz1qwTxC2ocw5rqp8ktm2XyYkl8riBVuqlXwfefTxsR2YFpgz9vkYUd5Az9EVEG7
-6wGIyZbtmhK63eEeaqbKz2GHub467498BXeVrYysO+YuIGgCEYKznNDZ4j5aaDbo
-j5+4/z0Qvv6HEsxQd0f8br6lKJwgeRM6+fm7796HNPB0aqD7Zj9NRCLXjbB0DCgJ
-liH6rXMKR86ofgll9V2mRjesvhdKYgkGbOif9rvxVpLJ/6zdru5CE9yeuJZ59l+n
-YH/r6PzdJ4Q7yKrJX8qD6A60j4+biaU4MQ72KpsjhQNTTqF/HRwi0N54GDaknEwE
-TnJQHgLJDYqww9yKWtjjAgMBAAGjggIyMIICLjAdBgNVHQ4EFgQUOs4s70+yG30R
-4+GE78Hil7N3hkIwHwYDVR0jBBgwFoAUwL1SXb7SeLIW7LOjQ5XSBguZCDIwDwYD
-VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwGAYDVR0gAQH/BA4wDDAKBggr
-BgEFBQcOAjBhBgNVHR8EWjBYMFagVKBShlByc3luYzovL3Jwa2kuZXhhbXBsZS5u
-ZXQvcmVwb3NpdG9yeS8zQUNFMkNFRjRGQjIxQjdEMTFFM0UxODRFRkMxRTI5N0Iz
-Nzc4NjQyLmNybDBOBggrBgEFBQcBAQRCMEAwPgYIKwYBBQUHMAKGMnJzeW5jOi8v
-cnBraS5leGFtcGxlLm5ldC9yZXBvc2l0b3J5L2V4YW1wbGUtdGEuY2VyMIG5Bggr
-BgEFBQcBCwSBrDCBqTA+BggrBgEFBQcwCoYycnN5bmM6Ly9ycGtpLmV4YW1wbGUu
-bmV0L3JlcG9zaXRvcnkvZXhhbXBsZS1jYS5tZnQwNQYIKwYBBQUHMA2GKWh0dHBz
-Oi8vcnJkcC5leGFtcGxlLm5ldC9ub3RpZmljYXRpb24ueG1sMDAGCCsGAQUFBzAF
-hiRyc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVwb3NpdG9yeS8wHwYIKwYBBQUH
-AQcBAf8EEDAOMAwEAgABMAYDBADAAAIwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAK
-AgMA+/ACAwD78TANBgkqhkiG9w0BAQsFAAOCAQEAGgn+1s4Vbp5CIPVtDG+gSjgU
-kUCnUdFK8kE6cHtcwo/RGah2QBEhtUXk7U19OvEjvsGbXKhhVfGkvJV6/rxXxnTF
-M+D+//Ef5Lvsxbxc85UDmhT5YDaDkuS9ClSEedZsN9/4bNzOve/JYB0Xj8GnLFH8
-OJo38poa5o2veqcmuwNtsAa/hAKRgDAWGD/gMsNZd83zVBgvIVasYDYXyapClD/x
-e3YCyWDJBJoJkFCoRB+Fb8lMAUFYx988S+BZGWA4VKGMUtPvdCtDwQak6c4PTziH
-/10Tc9Jxst1F0nCdmfFyMWRHNw3e5y8pmEc3WwzihGhuuOvdLzVdoEMRSwQ+/g==
------END CERTIFICATE-----
+   <figure><artwork><![CDATA[
+   -----BEGIN CERTIFICATE-----
+   MIIE7DCCA9SgAwIBAgIUcyCzS10hdfG65kbRq7toQAvRDLkwDQYJKoZIhvcNAQEL
+   BQAwFTETMBEGA1UEAxMKZXhhbXBsZS10YTAeFw0yMzA5MjMxNTU1MzhaFw0yNDA5
+   MjIxNTU1MzhaMDMxMTAvBgNVBAMTKDNBQ0UyQ0VGNEZCMjFCN0QxMUUzRTE4NEVG
+   QzFFMjk3QjM3Nzg2NDIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDc
+   zz1qwTxC2ocw5rqp8ktm2XyYkl8riBVuqlXwfefTxsR2YFpgz9vkYUd5Az9EVEG7
+   6wGIyZbtmhK63eEeaqbKz2GHub467498BXeVrYysO+YuIGgCEYKznNDZ4j5aaDbo
+   j5+4/z0Qvv6HEsxQd0f8br6lKJwgeRM6+fm7796HNPB0aqD7Zj9NRCLXjbB0DCgJ
+   liH6rXMKR86ofgll9V2mRjesvhdKYgkGbOif9rvxVpLJ/6zdru5CE9yeuJZ59l+n
+   YH/r6PzdJ4Q7yKrJX8qD6A60j4+biaU4MQ72KpsjhQNTTqF/HRwi0N54GDaknEwE
+   TnJQHgLJDYqww9yKWtjjAgMBAAGjggIUMIICEDAdBgNVHQ4EFgQUOs4s70+yG30R
+   4+GE78Hil7N3hkIwHwYDVR0jBBgwFoAUwL1SXb7SeLIW7LOjQ5XSBguZCDIwDwYD
+   VR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwGAYDVR0gAQH/BA4wDDAKBggr
+   BgEFBQcOAjBDBgNVHR8EPDA6MDigNqA0hjJyc3luYzovL3Jwa2kuZXhhbXBsZS5u
+   ZXQvcmVwb3NpdG9yeS9leGFtcGxlLXRhLmNybDBOBggrBgEFBQcBAQRCMEAwPgYI
+   KwYBBQUHMAKGMnJzeW5jOi8vcnBraS5leGFtcGxlLm5ldC9yZXBvc2l0b3J5L2V4
+   YW1wbGUtdGEuY2VyMIG5BggrBgEFBQcBCwSBrDCBqTA+BggrBgEFBQcwCoYycnN5
+   bmM6Ly9ycGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvcnkvZXhhbXBsZS1jYS5tZnQw
+   NQYIKwYBBQUHMA2GKWh0dHBzOi8vcnJkcC5leGFtcGxlLm5ldC9ub3RpZmljYXRp
+   b24ueG1sMDAGCCsGAQUFBzAFhiRyc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVw
+   b3NpdG9yeS8wHwYIKwYBBQUHAQcBAf8EEDAOMAwEAgABMAYDBADAAAIwIQYIKwYB
+   BQUHAQgBAf8EEjAQoA4wDDAKAgMA+/ACAwD78TANBgkqhkiG9w0BAQsFAAOCAQEA
+   arIrZWb22wFmP+hVjhdg3IsKHB6fQdMuUR0u2DyZTVvbL6C+HyGAH32pi5mR/QLX
+   FAfdqALaB7r68tQTGLIW6bGljT+BqUPJmZcj56x3cBLJlltxwFatTloypjFt3cls
+   xFCuuD9J2iBxc6odTKi6u0mhQjD+C9m4xkbe8XXWWx85IHm1s6rYbpGgiMWxBC80
+   qqAzmBHGROWKUEvh00EYIYdiAvyFcrj7QtDiRJL5TDOySVd9pWJkerDzhqwE1IaZ
+   rpHck+lkYTS7jTD++6v32HG62GdsmryOQUk3aU1rLb3kS8vzaGbrgHpGPid0Hd0x
+   ZSl1AoIMpp5mZ7/h9aW5+A==
+   -----END CERTIFICATE-----
 ]]></artwork></figure>
 
    <t>
    The CRL issued by the CA.</t>
 
-<figure><artwork><![CDATA[
------BEGIN X509 CRL-----
-MIIBrTCBlgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzQUNFMkNFRjRG
-QjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyFw0yMzA5MjAxODIzNTBaFw0y
-MzEwMjAxODIzNTBaoC8wLTAfBgNVHSMEGDAWgBQ6zizvT7IbfRHj4YTvweKXs3eG
-QjAKBgNVHRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEAiiqMfYMxDTKYosc77UM0
-qzLuVsik3QHRMZI1YC/WVMNnuNrppjKr5e9lrfHF92XX4nO7odJk9TuCT+xpn6of
-/E5XQMh0btrgRO4lFS8SBqhD32++j65EWeOVHxwwiVIw0Nq9l+5kNa3a5Rfvr03d
-/c2DvgIUmrhQkJqUEYH0009oTsx2cFNIURhgpwdXulCcaPVO8QnKE0Vz7JwmuQJH
-U1vj8wB7rbW9gszbimInb1WNjR8cGL/USnDBTtoc1GSjQyhPck/UGyh5zgrmbS5R
-HpDVvN3FM6f8nfuz8qNy7TC8umV8IUzkJ+3+bxlUnyPUV9VNuQOQJHIgWzciA0cS
-XQ==
------END X509 CRL-----
+   <figure><artwork><![CDATA[
+   -----BEGIN X509 CRL-----
+   MIIBrTCBlgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzQUNFMkNFRjRG
+   QjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyFw0yMzA5MjMxNTU1MzhaFw0y
+   MzEwMjMxNTU1MzhaoC8wLTAfBgNVHSMEGDAWgBQ6zizvT7IbfRHj4YTvweKXs3eG
+   QjAKBgNVHRQEAwIBATANBgkqhkiG9w0BAQsFAAOCAQEACwCNzcAoqbMcUL1kBY65
+   YhL95OnBqAcuc99pD4i9c1BmVOl7bXU3cJqLaOZ6Z8CmN0kBbcHyqlHBJ9oA/aYD
+   ByhxsjzKk7jxtM2IlTpEvCEqvnGLSVihgS3h0NA+sgWqHGL3Rhcj6hVsi+j9GENc
+   T6F9np1mxbI3i2xhgeDJG1pryvH0hWXh7yJiYS8ItNEaIIXDT3szK/J9wnPjukTR
+   5MITiK9P3TCFujawb3O7rIT5PPgkM6eiCdwDgt6gjmw6cow5+rMjNHSRa+GOviSd
+   gXljVDfJvF4tKHmw59Jc2aFnSGfX1/ITDNiNfXYpUYFOcsqxkYf8F0uO7AtbRmTF
+   2w==
+   -----END X509 CRL-----
 ]]></artwork></figure>
 
    <t>
@@ -1060,221 +1058,221 @@ XQ==
    for geofeed data signatures, so no AS numbers are included in the
    end-entity certificate.</t>
 
-<figure><artwork><![CDATA[
------BEGIN CERTIFICATE-----
-MIIEVjCCAz6gAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu0wDQYJKoZIhvcNAQEL
-BQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExRTNFMTg0RUZDMUUyOTdC
-Mzc3ODY0MjAeFw0yMzA5MjAxNjQ5MjhaFw0yNDA3MTYxNjQ5MjhaMDMxMTAvBgNV
-BAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM0NUFCRjA1M0ExODcwggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycTQrOb/qB2W3i3Ki8PhA/DEW
-yii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQgtPCVwr62hTQZCIowBN0BL0c
-K0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZmr5xphXRvE+mzuJVLgu2V1upm
-BXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXhaFLe08y4DPfr/S/tXJOBm7QzQp
-tmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKGzqTFCcc3EW9l5UFE1MFLlnoEog
-qtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQft5w6g6cmxG+aYDdIEB34zrAgMB
-AAGjggFgMIIBXDAdBgNVHQ4EFgQUkUZSo71RwUQmAZiIn1xFq/BToYcwHwYDVR0j
-BBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkIwDgYDVR0PAQH/BAQDAgeAMBgGA1Ud
-IAEB/wQOMAwwCgYIKwYBBQUHDgIwYQYDVR0fBFowWDBWoFSgUoZQcnN5bmM6Ly9y
-cGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvcnkvM0FDRTJDRUY0RkIyMUI3RDExRTNF
-MTg0RUZDMUUyOTdCMzc3ODY0Mi5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUF
-BzAChlByc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVwb3NpdG9yeS8zQUNFMkNF
-RjRGQjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyLmNlcjAfBggrBgEFBQcB
-BwEB/wQQMA4wDAQCAAEwBgMEAMAAAjANBgkqhkiG9w0BAQsFAAOCAQEAD6JvdAdo
-vWT72DHKaK4Bw5Yv88g2pPHxWo+sckYyVZzr3yy29JItOHOWXv9WHcsi1mCEmqkn
-JMjcCaj5RuHpR3s8EWyi5qomGOsE42w8aBpqfef9rapjW/O7o1p5LDm9qh/arw8O
-VNU9+fnVBdbGJSVoDZScDyX+uitGeE9/dzktNeFV4bLivs/9CTXTy9eQ9RKMLkvh
-a5sNwNMrSS79ps9+nvFvg3Ynbkc6JGYAQgZ8K0RfQwx37Vn/AmsfvKIJWf4HzMg3
-eHQp/BZbbZCbr4FEy2wQhkFqXk5F1xQj91+rlyXpdbhcvbM3SyIhiWBkinVJSA/C
-g1oJqaiTsNaoGw==
------END CERTIFICATE-----
+   <figure><artwork><![CDATA[
+   -----BEGIN CERTIFICATE-----
+   MIIEVjCCAz6gAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZvAwDQYJKoZIhvcNAQEL
+   BQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExRTNFMTg0RUZDMUUyOTdC
+   Mzc3ODY0MjAeFw0yMzA5MjMxNTU1MzhaFw0yNDA3MTkxNTU1MzhaMDMxMTAvBgNV
+   BAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM0NUFCRjA1M0ExODcwggEi
+   MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycTQrOb/qB2W3i3Ki8PhA/DEW
+   yii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQgtPCVwr62hTQZCIowBN0BL0c
+   K0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZmr5xphXRvE+mzuJVLgu2V1upm
+   BXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXhaFLe08y4DPfr/S/tXJOBm7QzQp
+   tmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKGzqTFCcc3EW9l5UFE1MFLlnoEog
+   qtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQft5w6g6cmxG+aYDdIEB34zrAgMB
+   AAGjggFgMIIBXDAdBgNVHQ4EFgQUkUZSo71RwUQmAZiIn1xFq/BToYcwHwYDVR0j
+   BBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkIwDgYDVR0PAQH/BAQDAgeAMBgGA1Ud
+   IAEB/wQOMAwwCgYIKwYBBQUHDgIwYQYDVR0fBFowWDBWoFSgUoZQcnN5bmM6Ly9y
+   cGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvcnkvM0FDRTJDRUY0RkIyMUI3RDExRTNF
+   MTg0RUZDMUUyOTdCMzc3ODY0Mi5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUF
+   BzAChlByc3luYzovL3Jwa2kuZXhhbXBsZS5uZXQvcmVwb3NpdG9yeS8zQUNFMkNF
+   RjRGQjIxQjdEMTFFM0UxODRFRkMxRTI5N0IzNzc4NjQyLmNlcjAfBggrBgEFBQcB
+   BwEB/wQQMA4wDAQCAAEwBgMEAMAAAjANBgkqhkiG9w0BAQsFAAOCAQEAlxt25FUe
+   e0+uCidTH+4p7At3u2ncgHcGTsag3UcoPjcE/I1JgQJRu9TiM4iNB1C7Lbdd131g
+   MdliL5GQ3P4QfKnfkuPR6S1V8suq6ZT1KQRyLJx+EPgDN2rb/iji0TOK6RKPNBdG
+   lXVLjth4x/uu1O4V54GLEhDAPQC8IUm5intL/Hx1M1x2ptN/+j5HD3XUXd3x13yi
+   s6u758nbA7ND40JNhGG5JNGQgDchL4IQzIhylMNC+bKUiyyMHz3MqoVAklIB86IW
+   Ucv72Mekq+i46T/w3RnaGn4x7RAJctVJWw3e5YMrFnQcuuaGOs0QcoxW7Bi4W7Eg
+   8fK1fd/f6fjZ9w==
+   -----END CERTIFICATE-----
 ]]></artwork></figure>
 
     <t>
    The end-entity certificate is displayed below in detail.  For
    brevity, the other two certificates are not.</t>
 
-	<figure><artwork><![CDATA[
-   0 1110: SEQUENCE {
-   4  830:  SEQUENCE {
-   8    3:   [0] {
-  10    1:    INTEGER 2
-         :     }
-  13   20:   INTEGER
-         :    27 AD 39 40 83 D7 F2 B5 B9 9B 86 70 C7 75 B2 B9
-         :    6E E1 66 ED
-  35   13:   SEQUENCE {
-  37    9:    OBJECT IDENTIFIER
-         :     sha256WithRSAEncryption (1 2 840 113549 1 1 11)
-  48    0:    NULL
-         :     }
-  50   51:   SEQUENCE {
-  52   49:    SET {
-  54   47:     SEQUENCE {
-  56    3:      OBJECT IDENTIFIER commonName (2 5 4 3)
-  61   40:      PrintableString 
-         :       '3ACE2CEF4FB21B7D11E3E184EFC1E297B3778642'
-         :       }
-         :      }
-         :     }
- 103   30:   SEQUENCE {
- 105   13:    UTCTime 20/09/2023 16:49:28 GMT
- 120   13:    UTCTime 16/07/2024 16:49:28 GMT
-         :     }
- 135   51:   SEQUENCE {
- 137   49:    SET {
- 139   47:     SEQUENCE {
- 141    3:      OBJECT IDENTIFIER commonName (2 5 4 3)
- 146   40:      PrintableString
-         :       '914652A3BD51C144260198889F5C45ABF053A187'
-         :       }
-         :      }
-         :     }
- 188  290:   SEQUENCE {
- 192   13:    SEQUENCE {
- 194    9:     OBJECT IDENTIFIER
-         :      rsaEncryption (1 2 840 113549 1 1 1)
- 205    0:     NULL
-         :      }
- 207  271:    BIT STRING, encapsulates {
- 212  266:     SEQUENCE {
- 216  257:      INTEGER
-         :      00 B2 71 34 2B 39 BF EA 07 65 B7 8B 72 A2 F0 F8
-         :      40 FC 31 16 CA 28 B6 4E 01 A8 F6 98 02 C0 EF 65
-         :      B0 84 48 E9 96 FF 93 E6 92 89 65 8F F6 44 9C CE
-         :      57 10 82 D3 C2 57 0A FA DA 14 D0 64 22 28 C0 13
-         :      74 04 BD 1C 2B 4F F9 93 58 A6 25 D8 B9 A9 D3 37
-         :      9E F2 AC C0 CF 02 9E 84 75 D6 F0 7C A5 01 70 AE
-         :      E6 66 AF 9C 69 85 74 6F 13 E9 B3 B8 95 4B 82 ED
-         :      95 D6 EA 66 05 7B 96 96 87 B2 9A E7 61 E9 65 89
-         :      F8 60 E3 C0 F5 CE DD 18 97 05 E8 C1 AC E1 4D 5E
-         :      16 85 2D ED 3C CB 80 CF 7E BF D2 FE D5 C9 38 19
-         :      BB 43 34 29 B6 66 CF 2D 8B 46 7E 9A D8 BB 8E 65
-         :      88 51 6A A8 FF 78 51 E2 E9 21 27 D7 77 7E 80 28
-         :      6C EA 4C 50 9C 73 71 16 F6 5E 54 14 4D 4C 14 B9
-         :      67 A0 4A 20 AA DA 0B A0 A0 01 B7 42 24 38 51 8A
-         :      78 2F C4 81 E6 81 75 62 DE E3 AF 5D 74 2F 6B 41
-         :      FB 79 C3 A8 3A 72 6C 46 F9 A6 03 74 81 01 DF 8C
-         :      EB
- 477    3:      INTEGER 65537
-         :       }
-         :      }
-         :     }
- 482  352:   [3] {
- 486  348:    SEQUENCE {
- 490   29:     SEQUENCE {
- 492    3:      OBJECT IDENTIFIER
-         :       subjectKeyIdentifier (2 5 29 14)
- 497   22:      OCTET STRING, encapsulates {
- 499   20:       OCTET STRING
-         :      91 46 52 A3 BD 51 C1 44 26 01 98 88 9F 5C 45 AB
-         :      F0 53 A1 87
-         :        }
-         :       }
- 521   31:     SEQUENCE {
- 523    3:      OBJECT IDENTIFIER
-         :       authorityKeyIdentifier (2 5 29 35)
- 528   24:      OCTET STRING, encapsulates {
- 530   22:       SEQUENCE {
- 532   20:        [0]
-         :      3A CE 2C EF 4F B2 1B 7D 11 E3 E1 84 EF C1 E2 97
-         :      B3 77 86 42
-         :         }
-         :        }
-         :       }
- 554   14:     SEQUENCE {
- 556    3:      OBJECT IDENTIFIER keyUsage (2 5 29 15)
- 561    1:      BOOLEAN TRUE
- 564    4:      OCTET STRING, encapsulates {
- 566    2:       BIT STRING 7 unused bits
-         :        '1'B (bit 0)
-         :        }
-         :       }
- 570   24:     SEQUENCE {
- 572    3:      OBJECT IDENTIFIER certificatePolicies (2 5 29 32)
- 577    1:      BOOLEAN TRUE
- 580   14:      OCTET STRING, encapsulates {
- 582   12:       SEQUENCE {
- 584   10:        SEQUENCE {
- 586    8:         OBJECT IDENTIFIER
-         :          resourceCertificatePolicy (1 3 6 1 5 5 7 14 2)
-         :          }
-         :         }
-         :        }
-         :       }
- 596   97:     SEQUENCE {
- 598    3:      OBJECT IDENTIFIER
-         :       cRLDistributionPoints (2 5 29 31)
- 603   90:      OCTET STRING, encapsulates {
- 605   88:       SEQUENCE {
- 607   86:        SEQUENCE {
- 609   84:         [0] {
- 611   82:          [0] {
- 613   80:           [6]
-         :          'rsync://rpki.example.net/repository/3ACE'
-         :          '2CEF4FB21B7D11E3E184EFC1E297B3778642.crl'
-         :            }
-         :           }
-         :          }
-         :         }
-         :        }
-         :       }
- 695  108:     SEQUENCE {
- 697    8:      OBJECT IDENTIFIER
-         :       authorityInfoAccess (1 3 6 1 5 5 7 1 1)
- 707   96:      OCTET STRING, encapsulates {
- 709   94:       SEQUENCE {
- 711   92:        SEQUENCE {
- 713    8:         OBJECT IDENTIFIER
-         :          caIssuers (1 3 6 1 5 5 7 48 2)
- 723   80:         [6]
-         :          'rsync://rpki.example.net/repository/3ACE'
-         :          '2CEF4FB21B7D11E3E184EFC1E297B3778642.cer'
-         :          }
-         :         }
-         :        }
-         :       }
- 805   31:     SEQUENCE {
- 807    8:      OBJECT IDENTIFIER
-         :       ipAddrBlocks (1 3 6 1 5 5 7 1 7)
- 817    1:      BOOLEAN TRUE
- 820   16:      OCTET STRING, encapsulates {
- 822   14:       SEQUENCE {
- 824   12:        SEQUENCE {
- 826    2:         OCTET STRING 00 01
- 830    6:         SEQUENCE {
- 832    4:          BIT STRING
-         :           '010000000000000000000011'B
-         :           }
-         :          }
-         :         }
-         :        }
-         :       }
-         :      }
-         :     }
-         :    }
- 838   13:  SEQUENCE {
- 840    9:   OBJECT IDENTIFIER
-         :    sha256WithRSAEncryption (1 2 840 113549 1 1 11)
- 851    0:   NULL
-         :    }
- 853  257:  BIT STRING
-         :   0F A2 6F 74 07 68 BD 64 FB D8 31 CA 68 AE 01 C3
-         :   96 2F F3 C8 36 A4 F1 F1 5A 8F AC 72 46 32 55 9C
-         :   EB DF 2C B6 F4 92 2D 38 73 96 5E FF 56 1D CB 22
-         :   D6 60 84 9A A9 27 24 C8 DC 09 A8 F9 46 E1 E9 47
-         :   7B 3C 11 6C A2 E6 AA 26 18 EB 04 E3 6C 3C 68 1A
-         :   6A 7D E7 FD AD AA 63 5B F3 BB A3 5A 79 2C 39 BD
-         :   AA 1F DA AF 0F 0E 54 D5 3D F9 F9 D5 05 D6 C6 25
-         :   25 68 0D 94 9C 0F 25 FE BA 2B 46 78 4F 7F 77 39
-         :   2D 35 E1 55 E1 B2 E2 BE CF FD 09 35 D3 CB D7 90
-         :   F5 12 8C 2E 4B E1 6B 9B 0D C0 D3 2B 49 2E FD A6
-         :   CF 7E 9E F1 6F 83 76 27 6E 47 3A 24 66 00 42 06
-         :   7C 2B 44 5F 43 0C 77 ED 59 FF 02 6B 1F BC A2 09
-         :   59 FE 07 CC C8 37 78 74 29 FC 16 5B 6D 90 9B AF
-         :   81 44 CB 6C 10 86 41 6A 5E 4E 45 D7 14 23 F7 5F
-         :   AB 97 25 E9 75 B8 5C BD B3 37 4B 22 21 89 60 64
-         :   8A 75 49 48 0F C2 83 5A 09 A9 A8 93 B0 D6 A8 1B
-         :   }
+   <figure><artwork><![CDATA[
+      0 1110: SEQUENCE {
+      4  830:  SEQUENCE {
+      8    3:   [0] {
+     10    1:    INTEGER 2
+            :     }
+     13   20:   INTEGER
+            :    27 AD 39 40 83 D7 F2 B5 B9 9B 86 70 C7 75 B2 B9
+            :    6E E1 66 F0
+     35   13:   SEQUENCE {
+     37    9:    OBJECT IDENTIFIER
+            :     sha256WithRSAEncryption (1 2 840 113549 1 1 11)
+     48    0:    NULL
+            :     }
+     50   51:   SEQUENCE {
+     52   49:    SET {
+     54   47:     SEQUENCE {
+     56    3:      OBJECT IDENTIFIER commonName (2 5 4 3)
+     61   40:      PrintableString
+            :       '3ACE2CEF4FB21B7D11E3E184EFC1E297B3778642'
+            :       }
+            :      }
+            :     }
+    103   30:   SEQUENCE {
+    105   13:    UTCTime 23/09/2023 15:55:38 GMT
+    120   13:    UTCTime 19/07/2024 15:55:38 GMT
+            :     }
+    135   51:   SEQUENCE {
+    137   49:    SET {
+    139   47:     SEQUENCE {
+    141    3:      OBJECT IDENTIFIER commonName (2 5 4 3)
+    146   40:      PrintableString
+            :       '914652A3BD51C144260198889F5C45ABF053A187'
+            :       }
+            :      }
+            :     }
+    188  290:   SEQUENCE {
+    192   13:    SEQUENCE {
+    194    9:     OBJECT IDENTIFIER
+            :      rsaEncryption (1 2 840 113549 1 1 1)
+    205    0:     NULL
+            :      }
+    207  271:    BIT STRING, encapsulates {
+    212  266:     SEQUENCE {
+    216  257:      INTEGER
+            :      00 B2 71 34 2B 39 BF EA 07 65 B7 8B 72 A2 F0 F8
+            :      40 FC 31 16 CA 28 B6 4E 01 A8 F6 98 02 C0 EF 65
+            :      B0 84 48 E9 96 FF 93 E6 92 89 65 8F F6 44 9C CE
+            :      57 10 82 D3 C2 57 0A FA DA 14 D0 64 22 28 C0 13
+            :      74 04 BD 1C 2B 4F F9 93 58 A6 25 D8 B9 A9 D3 37
+            :      9E F2 AC C0 CF 02 9E 84 75 D6 F0 7C A5 01 70 AE
+            :      E6 66 AF 9C 69 85 74 6F 13 E9 B3 B8 95 4B 82 ED
+            :      95 D6 EA 66 05 7B 96 96 87 B2 9A E7 61 E9 65 89
+            :      F8 60 E3 C0 F5 CE DD 18 97 05 E8 C1 AC E1 4D 5E
+            :      16 85 2D ED 3C CB 80 CF 7E BF D2 FE D5 C9 38 19
+            :      BB 43 34 29 B6 66 CF 2D 8B 46 7E 9A D8 BB 8E 65
+            :      88 51 6A A8 FF 78 51 E2 E9 21 27 D7 77 7E 80 28
+            :      6C EA 4C 50 9C 73 71 16 F6 5E 54 14 4D 4C 14 B9
+            :      67 A0 4A 20 AA DA 0B A0 A0 01 B7 42 24 38 51 8A
+            :      78 2F C4 81 E6 81 75 62 DE E3 AF 5D 74 2F 6B 41
+            :      FB 79 C3 A8 3A 72 6C 46 F9 A6 03 74 81 01 DF 8C
+            :      EB
+    477    3:      INTEGER 65537
+            :       }
+            :      }
+            :     }
+    482  352:   [3] {
+    486  348:    SEQUENCE {
+    490   29:     SEQUENCE {
+    492    3:      OBJECT IDENTIFIER
+            :       subjectKeyIdentifier (2 5 29 14)
+    497   22:      OCTET STRING, encapsulates {
+    499   20:       OCTET STRING
+            :      91 46 52 A3 BD 51 C1 44 26 01 98 88 9F 5C 45 AB
+            :      F0 53 A1 87
+            :        }
+            :       }
+    521   31:     SEQUENCE {
+    523    3:      OBJECT IDENTIFIER
+            :       authorityKeyIdentifier (2 5 29 35)
+    528   24:      OCTET STRING, encapsulates {
+    530   22:       SEQUENCE {
+    532   20:        [0]
+            :      3A CE 2C EF 4F B2 1B 7D 11 E3 E1 84 EF C1 E2 97
+            :      B3 77 86 42
+            :         }
+            :        }
+            :       }
+    554   14:     SEQUENCE {
+    556    3:      OBJECT IDENTIFIER keyUsage (2 5 29 15)
+    561    1:      BOOLEAN TRUE
+    564    4:      OCTET STRING, encapsulates {
+    566    2:       BIT STRING 7 unused bits
+            :        '1'B (bit 0)
+            :        }
+            :       }
+    570   24:     SEQUENCE {
+    572    3:      OBJECT IDENTIFIER certificatePolicies (2 5 29 32)
+    577    1:      BOOLEAN TRUE
+    580   14:      OCTET STRING, encapsulates {
+    582   12:       SEQUENCE {
+    584   10:        SEQUENCE {
+    586    8:         OBJECT IDENTIFIER
+            :          resourceCertificatePolicy (1 3 6 1 5 5 7 14 2)
+            :          }
+            :         }
+            :        }
+            :       }
+    596   97:     SEQUENCE {
+    598    3:      OBJECT IDENTIFIER
+            :       cRLDistributionPoints (2 5 29 31)
+    603   90:      OCTET STRING, encapsulates {
+    605   88:       SEQUENCE {
+    607   86:        SEQUENCE {
+    609   84:         [0] {
+    611   82:          [0] {
+    613   80:           [6]
+            :          'rsync://rpki.example.net/repository/3ACE'
+            :          '2CEF4FB21B7D11E3E184EFC1E297B3778642.crl'
+            :            }
+            :           }
+            :          }
+            :         }
+            :        }
+            :       }
+    695  108:     SEQUENCE {
+    697    8:      OBJECT IDENTIFIER
+            :       authorityInfoAccess (1 3 6 1 5 5 7 1 1)
+    707   96:      OCTET STRING, encapsulates {
+    709   94:       SEQUENCE {
+    711   92:        SEQUENCE {
+    713    8:         OBJECT IDENTIFIER
+            :          caIssuers (1 3 6 1 5 5 7 48 2)
+    723   80:         [6]
+            :          'rsync://rpki.example.net/repository/3ACE'
+            :          '2CEF4FB21B7D11E3E184EFC1E297B3778642.cer'
+            :          }
+            :         }
+            :        }
+            :       }
+    805   31:     SEQUENCE {
+    807    8:      OBJECT IDENTIFIER
+            :       ipAddrBlocks (1 3 6 1 5 5 7 1 7)
+    817    1:      BOOLEAN TRUE
+    820   16:      OCTET STRING, encapsulates {
+    822   14:       SEQUENCE {
+    824   12:        SEQUENCE {
+    826    2:         OCTET STRING 00 01
+    830    6:         SEQUENCE {
+    832    4:          BIT STRING
+            :           '010000000000000000000011'B
+            :           }
+            :          }
+            :         }
+            :        }
+            :       }
+            :      }
+            :     }
+            :    }
+    838   13:  SEQUENCE {
+    840    9:   OBJECT IDENTIFIER
+            :    sha256WithRSAEncryption (1 2 840 113549 1 1 11)
+    851    0:   NULL
+            :    }
+    853  257:  BIT STRING
+            :   97 1B 76 E4 55 1E 7B 4F AE 0A 27 53 1F EE 29 EC
+            :   0B 77 BB 69 DC 80 77 06 4E C6 A0 DD 47 28 3E 37
+            :   04 FC 8D 49 81 02 51 BB D4 E2 33 88 8D 07 50 BB
+            :   2D B7 5D D7 7D 60 31 D9 62 2F 91 90 DC FE 10 7C
+            :   A9 DF 92 E3 D1 E9 2D 55 F2 CB AA E9 94 F5 29 04
+            :   72 2C 9C 7E 10 F8 03 37 6A DB FE 28 E2 D1 33 8A
+            :   E9 12 8F 34 17 46 95 75 4B 8E D8 78 C7 FB AE D4
+            :   EE 15 E7 81 8B 12 10 C0 3D 00 BC 21 49 B9 8A 7B
+            :   4B FC 7C 75 33 5C 76 A6 D3 7F FA 3E 47 0F 75 D4
+            :   5D DD F1 D7 7C A2 B3 AB BB E7 C9 DB 03 B3 43 E3
+            :   42 4D 84 61 B9 24 D1 90 80 37 21 2F 82 10 CC 88
+            :   72 94 C3 42 F9 B2 94 8B 2C 8C 1F 3D CC AA 85 40
+            :   92 52 01 F3 A2 16 51 CB FB D8 C7 A4 AB E8 B8 E9
+            :   3F F0 DD 19 DA 1A 7E 31 ED 10 09 72 D5 49 5B 0D
+            :   DE E5 83 2B 16 74 1C BA E6 86 3A CD 10 72 8C 56
+            :   EC 18 B8 5B B1 20 F1 F2 B5 7D DF DF E9 F8 D9 F7
+            :   }
 ]]></artwork></figure>
 
    <t>
@@ -1282,78 +1280,77 @@ g1oJqaiTsNaoGw==
    private key is provided.  For brevity, the other two private
    keys are not.</t>
 
-    <figure><artwork><![CDATA[
------BEGIN RSA PRIVATE KEY-----
-MIIEpQIBAAKCAQEAsnE0Kzm/6gdlt4tyovD4QPwxFsootk4BqPaYAsDvZbCESOmW
-/5Pmkollj/ZEnM5XEILTwlcK+toU0GQiKMATdAS9HCtP+ZNYpiXYuanTN57yrMDP
-Ap6EddbwfKUBcK7mZq+caYV0bxPps7iVS4LtldbqZgV7lpaHsprnYellifhg48D1
-zt0YlwXowazhTV4WhS3tPMuAz36/0v7VyTgZu0M0KbZmzy2LRn6a2LuOZYhRaqj/
-eFHi6SEn13d+gChs6kxQnHNxFvZeVBRNTBS5Z6BKIKraC6CgAbdCJDhRingvxIHm
-gXVi3uOvXXQva0H7ecOoOnJsRvmmA3SBAd+M6wIDAQABAoIBAQCyB0FeMuKm8bRo
-18aKjFGSPEoZi53srIz5bvUgIi92TBLez7ZnzL6Iym26oJ+5th+lCHGO/dqlhXio
-pI50C5Yc9TFbblb/ECOsuCuuqKFjZ8CD3GVsHozXKJeMM+/o5YZXQrORj6UnwT0z
-ol/JE5pIGUCIgsXX6tz9s5BP3lUAvVQHsv6+vEVKLxQ3wj/1vIL8O/CN036EV0GJ
-mpkwmygPjfECT9wbWo0yn3jxJb36+M/QjjUP28oNIVn/IKoPZRXnqchEbuuCJ651
-IsaFSqtiThm4WZtvCH/IDq+6/dcMucmTjIRcYwW7fdHfjplllVPve9c/OmpWEQvF
-t3ArWUt5AoGBANs4764yHxo4mctLIE7G7l/tf9bP4KKUiYw4R4ByEocuqMC4yhmt
-MPCfOFLOQet71OWCkjP2L/7EKUe9yx7G5KmxAHY6jOjvcRkvGsl6lWFOsQ8p126M
-Y9hmGzMOjtsdhAiMmOWKzjvm4WqfMgghQe+PnjjSVkgTt+7BxpIuGBAvAoGBANBg
-26FF5cDLpixOd3Za1YXsOgguwCaw3Plvi7vUZRpa/zBMELEtyOebfakkIRWNm07l
-nE+lAZwxm+29PTD0nqCFE91teyzjnQaLO5kkAdJiFuVV3icLOGo399FrnJbKensm
-FGSli+3KxQhCNIJJfgWzq4bE0ioAMjdGbYXzIYQFAoGBAM6tuDJ36KDU+hIS6wu6
-O2TPSfZhF/zPo3pCWQ78/QDb+Zdw4IEiqoBA7F4NPVLg9Y/H8UTx9r/veqe7hPOo
-Ok7NpIzSmKTHkc5XfZ60Zn9OLFoKbaQ40a1kXoJdWEu2YROaUlAe9F6/Rog6PHYz
-vLE5qscRbu0XQhLkN+z7bg5bAoGBAKDsbDEb/dbqbyaAYpmwhH2sdRSkphg7Niwc
-DNm9qWa1J6Zw1+M87I6Q8naRREuU1IAVqqWHVLr/ROBQ6NTJ1Uc5/qFeT2XXUgkf
-taMKv61tuyjZK3sTmznMh0HfzUpWjEhWnCEuB+ZYVdmO52ZGw2A75RdrILL2+9Dc
-PvDXVubRAoGAdqXeSWoLxuzZXzl8rsaKrQsTYaXnOWaZieU1SL5vVe8nK257UDqZ
-E3ng2j5XPTUWli+aNGFEJGRoNtcQvO60O/sFZUhu52sqq9mWVYZNh1TB5aP8X+pV
-iFcZOLUvQEcN6PA+YQK5FU11rAI1M0Gm5RDnVnUl0L2xfCYxb7FzV6Y=
------END RSA PRIVATE KEY-----
+   <figure><artwork><![CDATA[
+   -----BEGIN RSA PRIVATE KEY-----
+   MIIEpQIBAAKCAQEAsnE0Kzm/6gdlt4tyovD4QPwxFsootk4BqPaYAsDvZbCESOmW
+   /5Pmkollj/ZEnM5XEILTwlcK+toU0GQiKMATdAS9HCtP+ZNYpiXYuanTN57yrMDP
+   Ap6EddbwfKUBcK7mZq+caYV0bxPps7iVS4LtldbqZgV7lpaHsprnYellifhg48D1
+   zt0YlwXowazhTV4WhS3tPMuAz36/0v7VyTgZu0M0KbZmzy2LRn6a2LuOZYhRaqj/
+   eFHi6SEn13d+gChs6kxQnHNxFvZeVBRNTBS5Z6BKIKraC6CgAbdCJDhRingvxIHm
+   gXVi3uOvXXQva0H7ecOoOnJsRvmmA3SBAd+M6wIDAQABAoIBAQCyB0FeMuKm8bRo
+   18aKjFGSPEoZi53srIz5bvUgIi92TBLez7ZnzL6Iym26oJ+5th+lCHGO/dqlhXio
+   pI50C5Yc9TFbblb/ECOsuCuuqKFjZ8CD3GVsHozXKJeMM+/o5YZXQrORj6UnwT0z
+   ol/JE5pIGUCIgsXX6tz9s5BP3lUAvVQHsv6+vEVKLxQ3wj/1vIL8O/CN036EV0GJ
+   mpkwmygPjfECT9wbWo0yn3jxJb36+M/QjjUP28oNIVn/IKoPZRXnqchEbuuCJ651
+   IsaFSqtiThm4WZtvCH/IDq+6/dcMucmTjIRcYwW7fdHfjplllVPve9c/OmpWEQvF
+   t3ArWUt5AoGBANs4764yHxo4mctLIE7G7l/tf9bP4KKUiYw4R4ByEocuqMC4yhmt
+   MPCfOFLOQet71OWCkjP2L/7EKUe9yx7G5KmxAHY6jOjvcRkvGsl6lWFOsQ8p126M
+   Y9hmGzMOjtsdhAiMmOWKzjvm4WqfMgghQe+PnjjSVkgTt+7BxpIuGBAvAoGBANBg
+   26FF5cDLpixOd3Za1YXsOgguwCaw3Plvi7vUZRpa/zBMELEtyOebfakkIRWNm07l
+   nE+lAZwxm+29PTD0nqCFE91teyzjnQaLO5kkAdJiFuVV3icLOGo399FrnJbKensm
+   FGSli+3KxQhCNIJJfgWzq4bE0ioAMjdGbYXzIYQFAoGBAM6tuDJ36KDU+hIS6wu6
+   O2TPSfZhF/zPo3pCWQ78/QDb+Zdw4IEiqoBA7F4NPVLg9Y/H8UTx9r/veqe7hPOo
+   Ok7NpIzSmKTHkc5XfZ60Zn9OLFoKbaQ40a1kXoJdWEu2YROaUlAe9F6/Rog6PHYz
+   vLE5qscRbu0XQhLkN+z7bg5bAoGBAKDsbDEb/dbqbyaAYpmwhH2sdRSkphg7Niwc
+   DNm9qWa1J6Zw1+M87I6Q8naRREuU1IAVqqWHVLr/ROBQ6NTJ1Uc5/qFeT2XXUgkf
+   taMKv61tuyjZK3sTmznMh0HfzUpWjEhWnCEuB+ZYVdmO52ZGw2A75RdrILL2+9Dc
+   PvDXVubRAoGAdqXeSWoLxuzZXzl8rsaKrQsTYaXnOWaZieU1SL5vVe8nK257UDqZ
+   E3ng2j5XPTUWli+aNGFEJGRoNtcQvO60O/sFZUhu52sqq9mWVYZNh1TB5aP8X+pV
+   iFcZOLUvQEcN6PA+YQK5FU11rAI1M0Gm5RDnVnUl0L2xfCYxb7FzV6Y=
+   -----END RSA PRIVATE KEY-----
 ]]></artwork></figure>
 
     <t>
    Signing of "192.0.2.0/24,US,WA,Seattle," (terminated by CR and LF),
    yields the following detached CMS signature.</t>
 
-    <figure><artwork><![CDATA[
-# RPKI Signature: 192.0.2.0/24
-# MIIGTgYJKoZIhvcNAQcCoIIGPzCCBjsCAQMxDTALBglghkgBZQMEAgEwDQYLKoZ
-# IhvcNAQkQAS+gggRoMIIEZDCCA0ygAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZu
-# wwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExR
-# TNFMTg0RUZDMUUyOTdCMzc3ODY0MjAeFw0yMzA5MTYyMTAzMjhaFw0yNDA3MTIy
-# MTAzMjhaMDMxMTAvBgNVBAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM
-# 0NUFCRjA1M0ExODcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycT
-# QrOb/qB2W3i3Ki8PhA/DEWyii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQg
-# tPCVwr62hTQZCIowBN0BL0cK0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZm
-# r5xphXRvE+mzuJVLgu2V1upmBXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXha
-# FLe08y4DPfr/S/tXJOBm7QzQptmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKG
-# zqTFCcc3EW9l5UFE1MFLlnoEogqtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQ
-# ft5w6g6cmxG+aYDdIEB34zrAgMBAAGjggFuMIIBajAdBgNVHQ4EFgQUkUZSo71R
-# wUQmAZiIn1xFq/BToYcwHwYDVR0jBBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkI
-# wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwGAYDVR0gAQH/BA4wDDAKBg
-# grBgEFBQcOAjBhBgNVHR8EWjBYMFagVKBShlByc3luYzovL3Jwa2kuZXhhbXBsZ
-# S5uZXQvcmVwb3NpdG9yeS8zQUNFMkNFRjRGQjIxQjdEMTFFM0UxODRFRkMxRTI5
-# N0IzNzc4NjQyLmNybDBsBggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUHJzeW5
-# jOi8vcnBraS5leGFtcGxlLm5ldC9yZXBvc2l0b3J5LzNBQ0UyQ0VGNEZCMjFCN0
-# QxMUUzRTE4NEVGQzFFMjk3QjM3Nzg2NDIuY2VyMB8GCCsGAQUFBwEHAQH/BBAwD
-# jAMBAIAATAGAwQAwAACMA0GCSqGSIb3DQEBCwUAA4IBAQAIdkoBMQydWkkaE91z
-# FTX6xIzzDhllfDR5bgw8C2XrAkTiWlMce+/A794a7j3+fIAyDrQ1fjgPLof6I7x
-# MaiqyNtb+5GqXNk+sHwjg6AnInZV2Xgz2X6lJdtNck25zGwfj/RZ8BxO+UUzP0J
-# UOCTAaCed2KOVF9qWfmXeZ2HPvZVD+01G0PNKdDGKzBmtWKzXsWVk00fvm+xaDs
-# /sBTf28O907AUM+2ipuFYfWYc2mPaT3C4uK0udl3/FhUzH6loqs/c1jIsL3mWd8
-# iR2eAwBa+rsp9sc3wbnPCjFOuFZKN85nnXzrbJ6dFjqNix9Z2it7TCmU89Jltre
-# Rt5Q1xX+mMYIBqjCCAaYCAQOAFJFGUqO9UcFEJgGYiJ9cRavwU6GHMAsGCWCGSA
-# FlAwQCAaBrMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABLzAcBgkqhkiG9w0BC
-# QUxDxcNMjMwOTE2MjEwMzI4WjAvBgkqhkiG9w0BCQQxIgQgK+LynlLxySDbBNGE
-# MFDMaKOPKqzlPoj7hW0EfKl9wRYwDQYJKoZIhvcNAQEBBQAEggEAm1SGhxyTWRb
-# jf+ewdePchggMKR8zY7FRy+Z5ietrNaWkF2ZgqluVmm3mRDpQDeqTYrcTcBdR3o
-# szs89XxWNf81Afs1mBcUdgPHxcghJNoVsDFmcPd+LEFikOtGjaFCwS2meF3RYaM
-# 51jKer8SObP9nqV1JdPYzaArIpzhjHUA1wktTblEmg9lEOJPqALMI9uL7ngcKaE
-# w4omrcNSBXt9vqge/I5wG7q9tMw2RRcYXTj1XG6nSm7bo9L4JQfBrsubaANmGO9
-# NEAZeHyTQq7TzO9w7KBsB3Cg8qRhCzAY8bznt+r1DVPpQj4EHUBizYUMQRCxD5o
-# IUjEELzssfleF8pQ==
-# End Signature: 192.0.2.0/24
+   <figure><artwork><![CDATA[
+   # RPKI Signature: 192.0.2.0/24
+   # MIIGQAYJKoZIhvcNAQcCoIIGMTCCBi0CAQMxDTALBglghkgBZQMEAgEwDQYLKoZ
+   # IhvcNAQkQAS+gggRaMIIEVjCCAz6gAwIBAgIUJ605QIPX8rW5m4Zwx3WyuW7hZv
+   # AwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoM0FDRTJDRUY0RkIyMUI3RDExR
+   # TNFMTg0RUZDMUUyOTdCMzc3ODY0MjAeFw0yMzA5MjMxNTU1MzhaFw0yNDA3MTkx
+   # NTU1MzhaMDMxMTAvBgNVBAMTKDkxNDY1MkEzQkQ1MUMxNDQyNjAxOTg4ODlGNUM
+   # 0NUFCRjA1M0ExODcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCycT
+   # QrOb/qB2W3i3Ki8PhA/DEWyii2TgGo9pgCwO9lsIRI6Zb/k+aSiWWP9kSczlcQg
+   # tPCVwr62hTQZCIowBN0BL0cK0/5k1imJdi5qdM3nvKswM8CnoR11vB8pQFwruZm
+   # r5xphXRvE+mzuJVLgu2V1upmBXuWloeymudh6WWJ+GDjwPXO3RiXBejBrOFNXha
+   # FLe08y4DPfr/S/tXJOBm7QzQptmbPLYtGfprYu45liFFqqP94UeLpISfXd36AKG
+   # zqTFCcc3EW9l5UFE1MFLlnoEogqtoLoKABt0IkOFGKeC/EgeaBdWLe469ddC9rQ
+   # ft5w6g6cmxG+aYDdIEB34zrAgMBAAGjggFgMIIBXDAdBgNVHQ4EFgQUkUZSo71R
+   # wUQmAZiIn1xFq/BToYcwHwYDVR0jBBgwFoAUOs4s70+yG30R4+GE78Hil7N3hkI
+   # wDgYDVR0PAQH/BAQDAgeAMBgGA1UdIAEB/wQOMAwwCgYIKwYBBQUHDgIwYQYDVR
+   # 0fBFowWDBWoFSgUoZQcnN5bmM6Ly9ycGtpLmV4YW1wbGUubmV0L3JlcG9zaXRvc
+   # nkvM0FDRTJDRUY0RkIyMUI3RDExRTNFMTg0RUZDMUUyOTdCMzc3ODY0Mi5jcmww
+   # bAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlByc3luYzovL3Jwa2kuZXhhbXB
+   # sZS5uZXQvcmVwb3NpdG9yeS8zQUNFMkNFRjRGQjIxQjdEMTFFM0UxODRFRkMxRT
+   # I5N0IzNzc4NjQyLmNlcjAfBggrBgEFBQcBBwEB/wQQMA4wDAQCAAEwBgMEAMAAA
+   # jANBgkqhkiG9w0BAQsFAAOCAQEAlxt25FUee0+uCidTH+4p7At3u2ncgHcGTsag
+   # 3UcoPjcE/I1JgQJRu9TiM4iNB1C7Lbdd131gMdliL5GQ3P4QfKnfkuPR6S1V8su
+   # q6ZT1KQRyLJx+EPgDN2rb/iji0TOK6RKPNBdGlXVLjth4x/uu1O4V54GLEhDAPQ
+   # C8IUm5intL/Hx1M1x2ptN/+j5HD3XUXd3x13yis6u758nbA7ND40JNhGG5JNGQg
+   # DchL4IQzIhylMNC+bKUiyyMHz3MqoVAklIB86IWUcv72Mekq+i46T/w3RnaGn4x
+   # 7RAJctVJWw3e5YMrFnQcuuaGOs0QcoxW7Bi4W7Eg8fK1fd/f6fjZ9zGCAaowggG
+   # mAgEDgBSRRlKjvVHBRCYBmIifXEWr8FOhhzALBglghkgBZQMEAgGgazAaBgkqhk
+   # iG9w0BCQMxDQYLKoZIhvcNAQkQAS8wHAYJKoZIhvcNAQkFMQ8XDTIzMDkyMzE1N
+   # TUzOFowLwYJKoZIhvcNAQkEMSIEICvi8p5S8ckg2wTRhDBQzGijjyqs5T6I+4Vt
+   # BHypfcEWMA0GCSqGSIb3DQEBAQUABIIBAKZND7pKdVdfpB6zaJN89wTt+sXd0io
+   # 0WULMc+o6gRJFt3wmKNW2nYPrDbocJ+Q/rDMGxbp4QetJ0MQtn1+AYAS8v5jPDO
+   # 4a63U4/mJ2D3wSnQsDP0lUVknqRzfnS66HgHqiOVdHB0U+OnMEJuqHNTLx0dknb
+   # L3zwxyDJTHdo+dMB0U9xdcjwpsPM3xqg57EXj5EIQK5JbardXCjrsysAnEdktUY
+   # oyayGNbbQelANYJcOmuHhSXArR+qqzvNP2MDRqqKEcpd65YW6FSnqlVMIBH2M3P
+   # D2F0p3sdm4IeGAZWaERVB4AXO1PUFDNdhamr4XpIwqIoAig7xiLm7j8qu5Oc=
+   # End Signature: 192.0.2.0/24
 ]]></artwork></figure>
 
       </section>