Coverage for Microsoft PKI policy requirements

[sleevi]

This is a top-level issue to capture overall progress towards having acceptable ZLint coverage for the Microsoft PKI policy requirements. It replaces the more general discussion from #277.

The list below should be considered incomplete until someone has time to do a full read through of the PKI Policy comparing the requirements listed with the existing ZLint lints. Any requirements not addressed (or that could be addressed with stricter lint results) should have corresponding issues created. Once the issue is created leave a comment on this overall issue to have the list updated.

I've started this issued based on my preparing a CA/Browser Forum Browser Alignment branch for the BRs.

Required data/tooling

• SPKI data for trusted roots - Microsoft trusted roots data set and assoc. tooling #359

Required lints (INCOMPLETE):

• Section 4: Program Technical Requirements
  • Separate EKUs on intermediates - Lint for Microsoft PKI policy EKU separation #360
  • Require the CABF EKUs on end-entity certificates - Lint for Microsoft PKI policy requiring CA/Browser Forum OIDs #361
  • OCSP URLs MUST be present in end-entity certificates - Lint for Microsoft PKI policy requiring OCSP #362