Keys used to sign OCSP responses must be protected in HSMs

[BenWilson-Mozilla]

The NCSSRs should state that the private signing keys for all OCSP responders must be protected in an HSM, as opposed to, for example, storage of OCSP private signing keys in software, which would be more susceptible to misuse and comprise. This issue came up during a threat-modeling discussion today in the weekly subgroup meeting. Protection of OCSP signing keys in HSMs should not just be an underlying assumption, but should be expressly required in the NCSSRs.

[bcmorton]

I think this should be a BR requirement and not a NCSSR requirement. Note the NCSSR does not have any key protection levels for any other private keys.

[clintwilson]

The NCSSRs should perhaps describe the security requirements for the HSMs themselves, but perhaps not the contents of those HSMs.