Folks, I finally got the draft document transferred onto the wiki, just about in time for CAOPS tomorrow morning. https://grid.ie/eugridpma/wiki/GuidelineOnPrivateKeyProtection2 ... which took a little more editing of bullet/numbering and stuff but I think I got it right. Moreover, I think I managed to simplify a few things. Things to ponder is the distinction between the different flavours of private keys, ie protected key, activation data, activated key. I've tried to keep it generic-ish, so a key is not necessarily an RSA key, although it does mention "certificate" and CA. Thanks --jens