Amend BRs to Clarify Auditing of "Parked" CA Keys

[BenWilson-Mozilla]

CAs create keys in a Key Ceremony (often with a Key Generation report) but might not be aware that key storage needs to be audited continuously with no gaps--for instance, with "parked" CA keys (CA keys that have not had a corresponding CA certificate issued). Currently, audits contain a list of names and SHA256 hashes of CA certificates that are in scope. But what about "parked" keys? The BRs should be amended to make it clear that period-of-time audits need to identify parked CA keys, too.

[BenWilson-Mozilla]

@bcmorton provided me with an example that has been helpful. Anyone else with contributions to my understanding of this issue is invited to send them to me.