This surprises me very much. Why would an operation of the public part of a certificate be used to generate a secret? Maybe I'm not understanding what this is for, but this sounds dangerous to me.