epass2003: key generation allows stricter privkey/pubkey ACLs