x/crypto/ocsp: the responder cert is not provided along with the OCSP response signature

[nhooyr]

The docs on ocsp.CreateResponse state that:

// The responder cert is used to populate the responder's name field, and the
// certificate itself is provided alongside the OCSP response signature.

But in the code, the responder cert is only used to populate the rawResponderID.

The certificate provided with the OCSP response signature seem to come from template.Certificate instead of the responder cert.

Is this an error in the docs/code or am I missing something?

[kreichgauer]

That does look like a bug to me. Perhaps we'd want to use responderCert if template.Cert is nil? /cc @agl