* require TokenRequest to be enabled and configured * bind ca.crt publisher to this feature rather than to TokenRequest