All CA functions now use request/response API

This means all 3 are subject to policy.