[xmpp] RFC 6120 CA cert keyUsage digitalSignature bit requirement?

[Simon Josefsson <[e-mail]>]

Hi,

I'm generating certificates for use in a XMPP environment, and I'm
seeking clarification of one aspect of RFC 6120:

   The following rules apply to certification authority (CA)
   certificates that are used by issuers of XMPP end entity
   certificates:
...
   2.  The certificate MUST contain a keyUsage extension with the
       digitalSignature bit set.

My question: Why is the digitalSignature bit a requirement?

Speculation: Was the keyCertSign bit intended here?  Reading RFC 5280 it
seems the keyCertSign would be more appropriate than digitalSignature.
What non-certificate/CRL objects is it that XMPP environments expect to
be signed by the CA?

      KeyUsage ::= BIT STRING {
           digitalSignature        (0),
...
           keyCertSign             (5),
...
      The digitalSignature bit is asserted when the subject public key
      is used for verifying digital signatures, other than signatures on
      certificates (bit 5) and CRLs (bit 6), such as those used in an
      entity authentication service, a data origin authentication
      service, and/or an integrity service.
...
      The keyCertSign bit is asserted when the subject public key is
      used for verifying signatures on public key certificates.  If the
      keyCertSign bit is asserted, then the cA bit in the basic
      constraints extension (Section 4.2.1.9) MUST also be asserted.
...
   If the keyUsage extension is present, then the subject public key
   MUST NOT be used to verify signatures on certificates or CRLs unless
   the corresponding keyCertSign or cRLSign bit is set.  If the subject
   public key is only to be used for verifying signatures on
   certificates and/or CRLs, then the digitalSignature and
   nonRepudiation bits SHOULD NOT be set.  However, the digitalSignature
   and/or nonRepudiation bits MAY be set in addition to the keyCertSign
   and/or cRLSign bits if the subject public key is to be used to verify
   signatures on certificates and/or CRLs as well as other objects.

Thanks,
/Simon