In the X.509 SVID spec, clarify key usage requirements for CAs.
In the X.509 SVID spec, clarify key usage requirements for CAs.

Signing certificates don't need to set cRLSign, and they probably shouldn't if
they know they aren't going to issue CRLs. The requirements prohibiting
irrelevant key usages are irrelevant for SPIFFE use cases. In particular, in
the future we may well want to sign things other than X.509 certificates with
SVID signing certificates, in which case digitalSignature is quite a reasonable
key usage to have.

spiffe/spiffe