If CA is limited to revoke, unrevoke and remove certificate, it can be operated without
key material (except CMP responder key)