Isn't the `cyboxCommon:ToolInformationType` used to characterize the tool used to make an observation, not the program responsible for the artifact? I agree that this is useful information to record, and that there's a lot of overlap with the fields in `ToolInformationType`, but it just feels a little strange to be co-mingling the two.