Lunch at Asqew. Dinner at Tandoori Oven, which really should open a location near where I work. Westford could totally support a third Indian restaurant.

The pkinit-nss module's error reporting doesn't encode trusted-certifiers right. Forgot to take the address of a pointer to a pointer to a struct when passing it into the encoder.

Oh, and Heimdal seems to like using AES to encrypt enveloped data.

The pkinit-nss module's CMS implementation wasn't sorting signed attributes correctly, because NSS's ASN.1 encoder is a BER encoder, and you only need to sort for DER. Oops. So feed the "unordered" data into encoder in the right order.