currently attestation is only possible for signing keys. It would be extremely valuable to also attest RSA wrap keys.
Use case: I want to export material from one hsm to another. I want to authenticate a certificate chain of the receiving hsm to guarantee that it is a genuine yubico product, with a particular serial number and a guarantee that the public key was generated and not imported. Unfortunately right now this is impossible, and instead I have to use a less secure approach where I generate a signing key, produce a cert chain for that one, and then manually construct a new, separate cert chain that uses the generated signing key as a CA root to certify the wrap key.
currently attestation is only possible for signing keys. It would be extremely valuable to also attest RSA wrap keys.
Use case: I want to export material from one hsm to another. I want to authenticate a certificate chain of the receiving hsm to guarantee that it is a genuine yubico product, with a particular serial number and a guarantee that the public key was generated and not imported. Unfortunately right now this is impossible, and instead I have to use a less secure approach where I generate a signing key, produce a cert chain for that one, and then manually construct a new, separate cert chain that uses the generated signing key as a CA root to certify the wrap key.