extend the OCSP client to sign the request and verify the response signature
extend the built-in default certificate profile to restrict the public key