CA certificates delivered by PKIAAS do not match the expected key usage extension

[sc-hsm]

That use case (mixed setup with an external Sub-CA) is just no well supported. But it is on the ToDo list.