-----TIMESTAMP COMMIT-----

Version: 1 Algorithm: sha1 Preimage: version:1,parent:c8fe62d72b82bb0fc58d4c0ef77ea634f8f1a055,tree:dcfab4d5ea540ed7f53da6e902cad43f310aee46 Digest: c309e57ef8f089f844266fd9e54d0b8a2dcd899f Timestamp: https://freetsa.org/tsr Info: Timestamp generated with GitTrustedTimestamps by Mabulous GmbH Version: 1 Policy OID: tsa_policy1 Hash Algorithm: sha1 Message data: 0000 - c3 09 e5 7e f8 f0 89 f8-44 26 6f d9 e5 4d 0b 8a ...~....D&o..M.. 0010 - 2d cd 89 9f -... Serial number: 0x08F0834A Time stamp: Oct 6 04:30:38 2026 GMT Accuracy: unspecified Ordering: yes Nonce: 0xE874C2316392D72B TSA: DirName:/O=Free TSA/OU=TSA/description=This certificate digitally signs documents and time stamp requests made using the freetsa.org online services/CN=www.freetsa.org/emailAddress=busilezas@mailbox.org/L=Wuerzburg/C=DE/ST=Bayern Extensions: -----BEGIN RFC3161 TOKEN----- MIIDmwYJKoZIhvcNAQcCoIIDjDCCA4gCAQMxDzANBglghkgBZQMEAgMFADCCAYEG CyqGSIb3DQEJEAEEoIIBcASCAWwwggFoAgEBBgQqAwQBMCEwCQYFKw4DAhoFAAQU wwnlfvjwifhEJm/Z5U0Lii3NiZ8CBAjwg0oYDzIwMjYxMDA2MDQzMDM4WgEB/wIJ AOh0wjFjktcroIIBE6SCAQ8wggELMREwDwYDVQQKDAhGcmVlIFRTQTEMMAoGA1UE CwwDVFNBMXYwdAYDVQQNDG1UaGlzIGNlcnRpZmljYXRlIGRpZ2l0YWxseSBzaWdu cyBkb2N1bWVudHMgYW5kIHRpbWUgc3RhbXAgcmVxdWVzdHMgbWFkZSB1c2luZyB0 aGUgZnJlZXRzYS5vcmcgb25saW5lIHNlcnZpY2VzMRgwFgYDVQQDDA93d3cuZnJl ZXRzYS5vcmcxJDAiBgkqhkiG9w0BCQEWFWJ1c2lsZXphc0BtYWlsYm94Lm9yZzES MBAGA1UEBwwJV3VlcnpidXJnMQswCQYDVQQGEwJERTEPMA0GA1UECAwGQmF5ZXJu MYIB6zCCAecCAQEwgaMwgZUxETAPBgNVBAoTCEZyZWUgVFNBMRAwDgYDVQQLEwdS b290IENBMRgwFgYDVQQDEw93d3cuZnJlZXRzYS5vcmcxIjAgBgkqhkiG9w0BCQEW E2J1c2lsZXphc0BnbWFpbC5jb20xEjAQBgNVBAcTCVd1ZXJ6YnVyZzEPMA0GA1UE CBMGQmF5ZXJuMQswCQYDVQQGEwJERQIJAMLphhYNqOnNMA0GCWCGSAFlAwQCAwUA oIG4MBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUxDxcN MjYxMDA2MDQzMDM4WjArBgsqhkiG9w0BCRACDDEcMBowGDAWBBRIH9U8U004QYDA KGUZoDb5iFRHZjBPBgkqhkiG9w0BCQQxQgRAZYfK/o1FOVSh+JbOxOkL8Y65XZKK f8+GctYADqSUj21t3xmyVFv338XSJAg8tBLiux6jEEUM4bvLX/k1BMn3BTAKBggq hkjOPQQDBARmMGQCMFxqkb11tRJ/dkG0D0FJy00hRePpVoJZzp/g7/RY/POBk23+ Q9ByFGACVvT8R4dH4gIwWEhfiaNCXdnM96TN8xoVOib7H5MZDRyeJUMC7ODO2lt6 ViLJt98jlV6AodyJLhlg -----END RFC3161 TOKEN----- Timestamp: https://tsa.cesnet.cz:3162/tsa Info: Timestamp generated with GitTrustedTimestamps by Mabulous GmbH Version: 1 Policy OID: 1.3.6.1.4.1.22408.1.2.3.45 Hash Algorithm: sha1 Message data: 0000 - c3 09 e5 7e f8 f0 89 f8-44 26 6f d9 e5 4d 0b 8a ...~....D&o..M.. 0010 - 2d cd 89 9f -... Serial number: 0x7B8E6EFB6BE95C1D Time stamp: Oct 6 04:30:39 2026 GMT Accuracy: unspecified seconds, unspecified millis, 0x01 micros Ordering: no Nonce: 0x47C6EF0B0FCA23E5 TSA: DirName:/DC=cz/DC=cesnet-ca/O=CESNET/CN=tsa.cesnet.cz Extensions: -----BEGIN RFC3161 TOKEN----- MIIE3wYJKoZIhvcNAQcCoIIE0DCCBMwCAQMxDTALBglghkgBZQMEAgEwgdIGCyqG SIb3DQEJEAEEoIHCBIG/MIG8AgEBBgwrBgEEAYGvCAECAy0wITAJBgUrDgMCGgUA BBTDCeV++PCJ+EQmb9nlTQuKLc2JnwIIe45u+2vpXB0YDzIwMjYxMDA2MDQzMDM5 WjADgQEBAghHxu8LD8oj5aBcpFowWDESMBAGCgmSJomT8ixkARkWAmN6MRkwFwYK CZImiZPyLGQBGRYJY2VzbmV0LWNhMQ8wDQYDVQQKDAZDRVNORVQxFjAUBgNVBAMM DXRzYS5jZXNuZXQuY3oxggPhMIID3QIBATBsMGAxEjAQBgoJkiaJk/IsZAEZFgJj ejEZMBcGCgmSJomT8ixkARkWCWNlc25ldC1jYTESMBAGA1UECgwJQ0VTTkVUIENB MRswGQYDVQQDDBJQZXJzb25hbCBTaWduaW5nIDICCEypBoHUTnzHMAsGCWCGSAFl AwQCAaCCAUgwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJ BTEPFw0yNjEwMDYwNDMwMzlaMCsGCSqGSIb3DQEJNDEeMBwwCwYJYIZIAWUDBAIB oQ0GCSqGSIb3DQEBCwUAMC8GCSqGSIb3DQEJBDEiBCBR7uc7NGvK3CL09insyp5Z HaTdwmedXAbLWgcRejXogDCBrQYLKoZIhvcNAQkQAi8xgZ0wgZowgZcwgZQEIBw7 ejf9btxySQfEE6VM0v+1ie7OnOWwYr0R52233q21MHAwZKRiMGAxEjAQBgoJkiaJ k/IsZAEZFgJjejEZMBcGCgmSJomT8ixkARkWCWNlc25ldC1jYTESMBAGA1UECgwJ Q0VTTkVUIENBMRswGQYDVQQDDBJQZXJzb25hbCBTaWduaW5nIDICCEypBoHUTnzH MA0GCSqGSIb3DQEBCwUABIICAE4TMcXlRz+l/9R2DJSv4kF+E6ftqdj+t9hdyuhN Fm1GIht69Lp6/f5boWmsqXooMTg+RJTD453gyFVVJxsEXrPEDa7y9e+BjfNUW1XD Nss7yWjSwgosnXDel8XIU88hxN990gwbVV0qAjMIZwYeE3ss6PNM7ReByyoXQc5e GP2bv7rnGo9EpbrLPQKKUxB0Y141wgWvcxd9dk1GKyfcYe4i+y0lsgME950tK5i6 DjAa2HevpYaWK9gT3aAtQ1dHbIZAUQin2gwsqXP9IYNnxJklByU/mOmVtzfrqCXm QvZEhkatiTQlQwP9aMSmDEUdXO1iWRpmd+7BBjqBQDR3qu2rHNoNqajuLu+6fnK9 84nZTRIEHKheaOaBsZVPtFshFjWtK8yGFD2JO1uFFReLH8SKzH5kwrY3SKRZ+8S0 8rmOIxDlyxdzyBpMOnQowiDxEsK24j41PgpCrBggGcPKRQ2XYtsarIdydaMZEm+0 Uqu6X1m6OdJREpzKbBu2QCgP/Fl1zKzv3Ujh5eUUbm4AzE17AaeVTkeuRha8DqKD xPlAnf06v8ScLppOsrrScXPAahoWSjIxN0eD0zWGjFFFdRoW/iwJXd5Kw2ouVG/V JWBRJssuUcKN5BbksyIe/cDcaBNIxYaJuPe8Bp6CYyqiq9BqUa7iw1qmIlvSDWkC J9Td -----END RFC3161 TOKEN-----
validate only recent commits
2026-10-06 10:15:39 +05:45 · 2026-10-06 10:14:15 +05:45 · 2026-10-06 03:50:52 +00:00 · 2026-10-05 16:55:55 +05:45 · 2026-10-05 16:54:27 +05:45 · 2026-10-05 10:14:53 +00:00
15 changed files with 977 additions and 84 deletions
@@ -0,0 +1,32 @@
 name: Validate Trusted Timestamps Actions Demo
 run-name: ${{ gitea.actor }} is validating the trusted timestamps of all commits 🚀
 on: [push]
 variables:
  EXPECTED_TRUSTANCHORS_HASH: "70a1c7e2fc62a0b62e44063f0e730b20b0f209d15c84b310ad06ce616c352829"
 jobs:
  Validate:
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Install extra software
        run: |
          apt-get update
          apt-get install -y xxd
      - name: Check out repository code
        uses: actions/checkout@v4
        with:
           fetch-depth: 0
      - name: Setup timestamping authorities
        run: |
          git config --local timestamping.tsa0.url https://freetsa.org/tsr
          bash -c 'yes | ./hooks/trust.sh https://freetsa.org/tsr'
          git config --local timestamping.tsa1.url https://tsa.cesnet.cz:3162/tsa
          bash -c 'yes | ./hooks/trust.sh https://tsa.cesnet.cz:3162/tsa'
      - name: Check hashes of all trustanchors
        run: |
          ./hooks/validate_trustanchors_hash.sh .git/hoqoks/trustanchors ${{ EXPECTED_TRUSTANCHORS_HASH }}
      - name: Validate timestamps of all commits
        run: |
          ./hooks/validate.sh --maxcommits 6
@@ -0,0 +1,95 @@
 subject=DC=cz, DC=cesnet-ca, O=CESNET, CN=tsa.cesnet.cz
 issuer=DC=cz, DC=cesnet-ca, O=CESNET CA, CN=Personal Signing 2
 -----BEGIN CERTIFICATE-----
 MIIFLjCCBBagAwIBAgIITKkGgdROfMcwDQYJKoZIhvcNAQELBQAwYDESMBAGCgmS
 JomT8ixkARkWAmN6MRkwFwYKCZImiZPyLGQBGRYJY2VzbmV0LWNhMRIwEAYDVQQK
 DAlDRVNORVQgQ0ExGzAZBgNVBAMMElBlcnNvbmFsIFNpZ25pbmcgMjAeFw0yNTAz
 MDUxMjAzMDVaFw0yODA0MjAwOTIwNDhaMFgxEjAQBgoJkiaJk/IsZAEZFgJjejEZ
 MBcGCgmSJomT8ixkARkWCWNlc25ldC1jYTEPMA0GA1UECgwGQ0VTTkVUMRYwFAYD
 VQQDDA10c2EuY2VzbmV0LmN6MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
 AgEAsGge0kedZML8Mm59LjfUgr5QMBOGFoSzbrQe5YR0t43p3ILiS6DcnCm/n8cv
 rX3eKkOPVmeDCQ/Snp+K6SBiWaKgzaAL/L6nuQdh7KoDzQO7+SdSa+q5HTghzca2
 CxUKuP+EUnE88apvI901lvW2lo/Vw0k4opcO4CClHTzhsdiLjxaFFnTBwMdv0juf
 3VmR6mVjLtgt8QIRoWNaUGPJ7uFk2MFZYmVB32JZu+whlW6p1gaxGSFpzK+mWcst
 uL1zME5B2sKCbzN2/Ozx2dAAs+aARdPgCGcIu6AtWL82YUun5UFWzjafSwwH5PD2
 Q5ozcTsGDHGRlt8dYXbTes2u7sIb8gwtT3RyHqwgxyPPUbWpTQg8wvxHubdSNlFQ
 0FRNfnN5t5VPQ78f2s7i8uT5s8j1LIrlccTDQ0/taipElSDzlm6AFCAhrRbCgTUx
 CphRJ/IQgcF140iAgWm3rqst9gcNOkn3je2DNsRJ9IoCfN/ydDleWXjGhbfFYkjm
 wRjTQh1P8khrv/o3HPr0M9wNA0vzQMtcQgUywxvKWaUCC/SClHz03qOq1/2YWnNn
 u+RCGGfXPmgiar63XUm4qUSGiRWsrkhKdX5TzRb08YgdewMQDlqounJSJ9pZwF8U
 zyZ3nM/ifJs8tlgvrUUprco6PpqLiloctYdQbfNpWI5Sli8CAwEAAaOB8zCB8DAM
 BgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFMEeu6Q/DhPfgZu+TGKy2bq+1ba7MEkG
 A1UdEQRCMECCDnRzYTEuY2VzbmV0LmN6gg50c2EyLmNlc25ldC5jeoIOdHNhMy5j
 ZXNuZXQuY3qCDnRzYTQuY2VzbmV0LmN6MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMI
 MD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jcmwuY2VzbmV0LWNhLmN6L1BlcnNv
 bmFsU2lnbmluZzIuY3JsMB0GA1UdDgQWBBSYPaL5La3Ol0VRsc4tA2boji4mNTAN
 BgkqhkiG9w0BAQsFAAOCAQEAFr8D9GjYwkeuY3oEj+kaJX7XCRK8SCmkKuhp6sWM
 xsJRVyXUWhht9OCecW79mEUUkK79DuAwpGdKsOeqILamjmR6bm0Pc9WhQOySVIm/
 54vB1dNWMmCL84xfheXIZI58sbWuUH7vSlBQJGADsyOEonZsBYPYnk4AwR0uM8Go
 Mrr0Y618u5FKT8GKT7ZajykGeRzhc83g4iDZU72GsCX0N7R2jhGhK1SfGegv/tSn
 3+2mvYbthcYV+745stxeae1HXiRrpnfUpkroqjpEHAcp+v+T8mGtrQTh+NVLd82W
 zMwqSaiOYCpKc0lBzV4fSTP7Cpbfsx6xOyYPfxcu8/LlcA==
 -----END CERTIFICATE-----
 subject=DC=cz, DC=cesnet-ca, O=CESNET CA, CN=Personal Signing 2
 issuer=DC=cz, DC=cesnet-ca, O=CESNET CA, CN=CESNET CA Root
 -----BEGIN CERTIFICATE-----
 MIIETTCCAzWgAwIBAgIHAPTqVoKaNDANBgkqhkiG9w0BAQsFADBcMRIwEAYKCZIm
 iZPyLGQBGRYCY3oxGTAXBgoJkiaJk/IsZAEZFgljZXNuZXQtY2ExEjAQBgNVBAoT
 CUNFU05FVCBDQTEXMBUGA1UEAxMOQ0VTTkVUIENBIFJvb3QwHhcNMTgwNDE4MDky
 MDQ4WhcNMjgwNDIwMDkyMDQ4WjBgMRIwEAYKCZImiZPyLGQBGRYCY3oxGTAXBgoJ
 kiaJk/IsZAEZFgljZXNuZXQtY2ExEjAQBgNVBAoMCUNFU05FVCBDQTEbMBkGA1UE
 AwwSUGVyc29uYWwgU2lnbmluZyAyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
 CgKCAQEApKhbabfUBLMtC10PXFQe+hJI4wpJFNkYt3HRud0rZKmRqlcpPJvc4PLr
 9kEjXS+CP6Ut0UUkDvl686Mi7PsdxYFgDCfj0P694UA2SsGvBShL0vlZVkH19YFJ
 tyY1imP3B94r57+umqKEEr9qxu9nwToS8AB6Ead4zBPMSnHZvyFPuD9Lsc/WhcUb
 HnUvZN9jrrV4D6AjyvaBFPPcDVLjgiGoEE50PVMHPT5ZHpwTBTpBgL3zjE5fmxI4
 HU7aD0orO0pg0kmZrQa98bnnVb7Wp9HhYHc9tPhLMhi9UdTBb9zwQCaezJ0gnS5K
 iEAT5ZCYRUYlg82R07Z8k8UnHjczYQIDAQABo4IBDjCCAQowDwYDVR0TAQH/BAUw
 AwEB/zALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFMEeu6Q/DhPfgZu+TGKy2bq+1ba7
 MB8GA1UdIwQYMBaAFJ5BMOPD1U6Mg46jPMl/o20TXYQlMG0GCCsGAQUFBwEBBGEw
 XzAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AuY2VzbmV0LWNhLmN6LzA2BggrBgEF
 BQcwAoYqaHR0cDovL2NydC5jZXNuZXQtY2EuY3ovQ0VTTkVUX0NBX1Jvb3QuY3J0
 MDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9jcmwuY2VzbmV0LWNhLmN6L0NFU05F
 VF9DQV9Sb290LmNybDANBgkqhkiG9w0BAQsFAAOCAQEApoIA2/rStoUKnWC+qz3P
 AZLtDiyuUqs4i4Lb18loxE67QdP9nDZEzwHrB9Cr4oxN9cTutdUiwDIBQKuLx3tH
 r7TyuwcIYhHlW0+Ih+yUeyXEJlvSfR29M7SXY2axw4TWv4qOT2LKlFGxFqZx4OwN
 aVMUDSFVr3E5J4doIB2u/pLd+LH1QdsUXF1VhIa+Is/HMhC2JvmdnFqOCypdQrSA
 Ski6L8GRONF4SwzXg/glOQaw0QR69CjrYcogne1d/3Mxwr45MVkPwMJXscPKiRam
 SSTj7AJpyic0xbFBwGu+T7BP0NujkY/CW96UoELgcPsKoTAg7j6BhrWsjrfEaqtu
 7Q==
 -----END CERTIFICATE-----
 subject=DC=cz, DC=cesnet-ca, O=CESNET CA, CN=CESNET CA Root
 issuer=DC=cz, DC=cesnet-ca, O=CESNET CA, CN=CESNET CA Root
 -----BEGIN CERTIFICATE-----
 MIIEDTCCAvWgAwIBAgIJAIf3+gBzaRRPMA0GCSqGSIb3DQEBBQUAMFwxEjAQBgoJ
 kiaJk/IsZAEZFgJjejEZMBcGCgmSJomT8ixkARkWCWNlc25ldC1jYTESMBAGA1UE
 ChMJQ0VTTkVUIENBMRcwFQYDVQQDEw5DRVNORVQgQ0EgUm9vdDAeFw0wOTAyMjQx
 MzE2MDJaFw0yOTAyMjQxMzE2MDJaMFwxEjAQBgoJkiaJk/IsZAEZFgJjejEZMBcG
 CgmSJomT8ixkARkWCWNlc25ldC1jYTESMBAGA1UEChMJQ0VTTkVUIENBMRcwFQYD
 VQQDEw5DRVNORVQgQ0EgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
 ggEBAPeL9R8QFCBHw/PlWt2wBnx0cCSiNAhlI7HInrzGmtHK/9MJQJpmcoToq91R
 Y+hdo7sVddNqbz3F+oeiKavz3wpdCZJtaPI8Sv44OlCtnxeuw0LkSAAfG3maue7X
 I4jFqCU7/NxcoursXHDMCRLqeKHkast0b4i7d1KOdoc6hMNVaVc1UY/wyimM+Pbh
 XRW4+iwnmJXlIqCumWaVKF0b1F0WK2LV5TRonsoFNPdVHBU795ObAXRsXWfiKwNK
 CX85l3AO37UN1wbQ7UvCzE88jYOanRxL1AKezCa1ca8AohqbqoVVtrRPUTMrlXG3
 JOBfRaG0+LPXxHwQ9zCjvV/9kFcCAwEAAaOB0TCBzjAdBgNVHQ4EFgQUnkEw48PV
 ToyDjqM8yX+jbRNdhCUwgY4GA1UdIwSBhjCBg4AUnkEw48PVToyDjqM8yX+jbRNd
 hCWhYKReMFwxEjAQBgoJkiaJk/IsZAEZFgJjejEZMBcGCgmSJomT8ixkARkWCWNl
 c25ldC1jYTESMBAGA1UEChMJQ0VTTkVUIENBMRcwFQYDVQQDEw5DRVNORVQgQ0Eg
 Um9vdIIJAIf3+gBzaRRPMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMA0G
 CSqGSIb3DQEBBQUAA4IBAQB+vy9hAwzjgjYTnTwfxK03Ze/07GnmulUxUIPOagHJ
 vGQojnjN3BGnMoXNhQrhhCy1BfKt88sweN/ELkeOsgthbQ24lX7YdgPEPSwY2iIB
 E0NWxG87+z5hmfo+M69Q9WS8b5aSd4v5pSzT4+s6UW2lsddbdpnI4OwEEVdmj4e1
 w0trIAfPsFSKx5jMvC0KzoO04fSAjxTj2bn4orRVWlVGUYmQm/Gq0w//f84zox/g
 /XjE+kQ+eFOpNeeJC2Tpl04BByskoOw4LybIZ6iSdrUjoLgrK3R1geXo86Sx8QWE
 VVWM2+1UCVV3AMhYwQUbgasrEPkZ79od6exSUb+ZTpWc
 -----END CERTIFICATE-----
@@ -0,0 +1,92 @@
 subject=O=Free TSA, OU=TSA, description=This certificate digitally signs documents and time stamp requests made using the freetsa.org online services, CN=www.freetsa.org, emailAddress=busilezas@mailbox.org, L=Wuerzburg, C=DE, ST=Bayern
 issuer=O=Free TSA, OU=Root CA, CN=www.freetsa.org, emailAddress=busilezas@gmail.com, L=Wuerzburg, ST=Bayern, C=DE
 -----BEGIN CERTIFICATE-----
 MIIGYDCCBEigAwIBAgIJAMLphhYNqOnNMA0GCSqGSIb3DQEBDQUAMIGVMREwDwYD
 VQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZy
 ZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIw
 EAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUw
 HhcNMjYwMjE1MTk0NDIyWhcNNDAwMjAyMTk0NDIyWjCCAQsxETAPBgNVBAoMCEZy
 ZWUgVFNBMQwwCgYDVQQLDANUU0ExdjB0BgNVBA0MbVRoaXMgY2VydGlmaWNhdGUg
 ZGlnaXRhbGx5IHNpZ25zIGRvY3VtZW50cyBhbmQgdGltZSBzdGFtcCByZXF1ZXN0
 cyBtYWRlIHVzaW5nIHRoZSBmcmVldHNhLm9yZyBvbmxpbmUgc2VydmljZXMxGDAW
 BgNVBAMMD3d3dy5mcmVldHNhLm9yZzEkMCIGCSqGSIb3DQEJARYVYnVzaWxlemFz
 QG1haWxib3gub3JnMRIwEAYDVQQHDAlXdWVyemJ1cmcxCzAJBgNVBAYTAkRFMQ8w
 DQYDVQQIDAZCYXllcm4wdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASiFeGhstbLhxix
 0o4UAumNSwHUUlOe3DBvs8fYs580wADW59oqGSCx15bp61TSmXkwLm1JW48XnbLL
 izP6ZtjcvshV3H9uz2bS53sgDXhg1wLbIhAtraC+fHCytHeuVaujggHmMIIB4jAJ
 BgNVHRMEAjAAMB0GA1UdDgQWBBQVwL0m69RdgtFdkyYxL+9wsotGXjAfBgNVHSME
 GDAWgBT6VQ2MNGZRQ0z357OnbJWveuaklzALBgNVHQ8EBAMCBsAwFgYDVR0lAQH/
 BAwwCgYIKwYBBQUHAwgwbAYIKwYBBQUHAQEEYDBeMDMGCCsGAQUFBzAChidodHRw
 Oi8vd3d3LmZyZWV0c2Eub3JnL2ZpbGVzL2NhY2VydC5wZW0wJwYIKwYBBQUHMAGG
 G2h0dHA6Ly93d3cuZnJlZXRzYS5vcmc6MjU2MDA3BgNVHR8EMDAuMCygKqAohiZo
 dHRwOi8vd3d3LmZyZWV0c2Eub3JnL2NybC9yb290X2NhLmNybDCByAYDVR0gBIHA
 MIG9MIG6BgMrBQgwgbIwMwYIKwYBBQUHAgEWJ2h0dHA6Ly93d3cuZnJlZXRzYS5v
 cmcvZnJlZXRzYV9jcHMuaHRtbDAyBggrBgEFBQcCARYmaHR0cDovL3d3dy5mcmVl
 dHNhLm9yZy9mcmVldHNhX2Nwcy5wZGYwRwYIKwYBBQUHAgIwOxo5RnJlZVRTQSB0
 cnVzdGVkIHRpbWVzdGFtcGluZyBTb2Z0d2FyZSBhcyBhIFNlcnZpY2UgKFNhYVMp
 MA0GCSqGSIb3DQEBDQUAA4ICAQBrMVS/YfnfMr0ziZnesBUOrDNRrNNgt3IgMNDw
 Nhwl6oKWHVIhlYnM/5boljfbpZTAbqvxHI3ztT0/swxQOqTat5qBJRAY/VH1n/T4
 M9uDjSuu3qfh0ZH5PL9ENqoVW44i5NT/znQev2MGXOAHwz9kZwwzz9MFX6hbGhBq
 Wa+nlAqb7Y72KFzj33m1OVHxV2Wl4YD9f91bZTFpUEGW4Ktbkmxpf/iGIPaf4WHp
 oBW/O6EzofMKYlz4yXyEBh0wRRVyXltLrj+MFHqhe+PsMBllq/dCaO4W/F+AuHEl
 u7aUYWMASelphWAJiUsNMr5HAoeCSSgilqf1CSoWC+k6e4334Fym+Iy4csMex+PG
 4rSdqXJVQ+AWEdRajSPKh7yDfpNkdnO6yqQJ/tSd11XQ5cL0M9jWuCD1zHlgA+u+
 R2cry3yo23jD7qTGLhZqUvXCyWigH30/Q/RXjjDwrc4DJiQ+gRY0FhdTYqlvgMBP
 r4LcJKnNksivdj+kbz7bVSbrBAzRiazK9l841/5XMtP9BvD0hKCpQFvP9PSgCC8E
 QnKqgSe26FSJBaAQcA5TnK8NF4jkbElBxf/zyh7P3IjHso35jtgUWD1/itg9BJWb
 YUwJ4tfILpB2F0wbk1GcZDCDZoyW3Xf3trApz/Zd93gF3joc9Hh9RFveKRzWQ7dd
 Ut3egQ==
 -----END CERTIFICATE-----
 subject=O=Free TSA, OU=Root CA, CN=www.freetsa.org, emailAddress=busilezas@gmail.com, L=Wuerzburg, ST=Bayern, C=DE
 issuer=O=Free TSA, OU=Root CA, CN=www.freetsa.org, emailAddress=busilezas@gmail.com, L=Wuerzburg, ST=Bayern, C=DE
 -----BEGIN CERTIFICATE-----
 MIIH/zCCBeegAwIBAgIJAMHphhYNqOmAMA0GCSqGSIb3DQEBDQUAMIGVMREwDwYD
 VQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZy
 ZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIw
 EAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUw
 HhcNMTYwMzEzMDE1MjEzWhcNNDEwMzA3MDE1MjEzWjCBlTERMA8GA1UEChMIRnJl
 ZSBUU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9y
 ZzEiMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJ
 V3VlcnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFMIICIjANBgkq
 hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtgKODjAy8REQ2WTNqUudAnjhlCrpE6ql
 mQfNppeTmVvZrH4zutn+NwTaHAGpjSGv4/WRpZ1wZ3BRZ5mPUBZyLgq0YrIfQ5Fx
 0s/MRZPzc1r3lKWrMR9sAQx4mN4z11xFEO529L0dFJjPF9MD8Gpd2feWzGyptlel
 b+PqT+++fOa2oY0+NaMM7l/xcNHPOaMz0/2olk0i22hbKeVhvokPCqhFhzsuhKsm
 q4Of/o+t6dI7sx5h0nPMm4gGSRhfq+z6BTRgCrqQG2FOLoVFgt6iIm/BnNffUr7V
 DYd3zZmIwFOj/H3DKHoGik/xK3E82YA2ZulVOFRW/zj4ApjPa5OFbpIkd0pmzxzd
 EcL479hSA9dFiyVmSxPtY5ze1P+BE9bMU1PScpRzw8MHFXxyKqW13Qv7LWw4sbk3
 SciB7GACbQiVGzgkvXG6y85HOuvWNvC5GLSiyP9GlPB0V68tbxz4JVTRdw/Xn/XT
 FNzRBM3cq8lBOAVt/PAX5+uFcv1S9wFE8YjaBfWCP1jdBil+c4e+0tdywT2oJmYB
 BF/kEt1wmGwMmHunNEuQNzh1FtJY54hbUfiWi38mASE7xMtMhfj/C4SvapiDN837
 gYaPfs8x3KZxbX7C3YAsFnJinlwAUss1fdKar8Q/YVs7H/nU4c4Ixxxz4f67fcVq
 M2ITKentbCMCAwEAAaOCAk4wggJKMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQD
 AgHGMB0GA1UdDgQWBBT6VQ2MNGZRQ0z357OnbJWveuaklzCBygYDVR0jBIHCMIG/
 gBT6VQ2MNGZRQ0z357OnbJWveuakl6GBm6SBmDCBlTERMA8GA1UEChMIRnJlZSBU
 U0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEi
 MCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3Vl
 cnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFggkAwemGFg2o6YAw
 MwYDVR0fBCwwKjAooCagJIYiaHR0cDovL3d3dy5mcmVldHNhLm9yZy9yb290X2Nh
 LmNybDCBzwYDVR0gBIHHMIHEMIHBBgorBgEEAYHyJAEBMIGyMDMGCCsGAQUFBwIB
 FidodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZyZWV0c2FfY3BzLmh0bWwwMgYIKwYB
 BQUHAgEWJmh0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMucGRmMEcG
 CCsGAQUFBwICMDsaOUZyZWVUU0EgdHJ1c3RlZCB0aW1lc3RhbXBpbmcgU29mdHdh
 cmUgYXMgYSBTZXJ2aWNlIChTYWFTKTA3BggrBgEFBQcBAQQrMCkwJwYIKwYBBQUH
 MAGGG2h0dHA6Ly93d3cuZnJlZXRzYS5vcmc6MjU2MDANBgkqhkiG9w0BAQ0FAAOC
 AgEAaK9+v5OFYu9M6ztYC+L69sw1omdyli89lZAfpWMMh9CRmJhM6KBqM/ipwoLt
 nxyxGsbCPhcQjuTvzm+ylN6VwTMmIlVyVSLKYZcdSjt/eCUN+41K7sD7GVmxZBAF
 ILnBDmTGJmLkrU0KuuIpj8lI/E6Z6NnmuP2+RAQSHsfBQi6sssnXMo4HOW5gtPO7
 gDrUpVXID++1P4XndkoKn7Svw5n0zS9fv1hxBcYIHPPQUze2u30bAQt0n0iIyRLz
 aWuhtpAtd7ffwEbASgzB7E+NGF4tpV37e8KiA2xiGSRqT5ndu28fgpOY87gD3ArZ
 DctZvvTCfHdAS5kEO3gnGGeZEVLDmfEsv8TGJa3AljVa5E40IQDsUXpQLi8G+UC4
 1DWZu8EVT4rnYaCw1VX7ShOR1PNCCvjb8S8tfdudd9zhU3gEB0rxdeTy1tVbNLXW
 99y90xcwr1ZIDUwM/xQ/noO8FRhm0LoPC73Ef+J4ZBdrvWwauF3zJe33d4ibxEcb
 8/pz5WzFkeixYM2nsHhqHsBKw7JPouKNXRnl5IAE1eFmqDyC7G/VT7OF669xM6hb
 Ut5G21JE4cNK6NNucS+fzg1JPX0+3VhsYZjj7D5uljRvQXrJ8iHgr/M6j2oLHvTA
 I2MLdq2qjZFDOCXsxBxJpbmLGBx9ow6ZerlUxzws2AWv2pk=
 -----END CERTIFICATE-----
@@ -0,0 +1,89 @@
 subject=DC = cz, DC = cesnet-ca, O = CESNET, CN = tsa.cesnet.cz
 issuer=DC = cz, DC = cesnet-ca, O = CESNET CA, CN = Personal Signing 2
 -----BEGIN CERTIFICATE-----
 MIIEDjCCAvagAwIBAgIIaveGaDrA13AwDQYJKoZIhvcNAQELBQAwYDESMBAGCgmS
 JomT8ixkARkWAmN6MRkwFwYKCZImiZPyLGQBGRYJY2VzbmV0LWNhMRIwEAYDVQQK
 DAlDRVNORVQgQ0ExGzAZBgNVBAMMElBlcnNvbmFsIFNpZ25pbmcgMjAeFw0yNDA4
 MDcwOTQ3MDRaFw0yNzA4MDcwOTQ3MDRaMFgxEjAQBgoJkiaJk/IsZAEZFgJjejEZ
 MBcGCgmSJomT8ixkARkWCWNlc25ldC1jYTEPMA0GA1UECgwGQ0VTTkVUMRYwFAYD
 VQQDDA10c2EuY2VzbmV0LmN6MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
 AQEAvWLHcBAB3TKzSyP/EpZucr0fet3wqwYYcH8XRCPZNh1+yj858l5UvSp7QHje
 LU8Twnx8/xrVZMteojL1RNaLUDm0TJD7tIkCkwILxY8qxQX8yYgFCQM9wgWzWiMN
 NR9/+W/3pr8HMPwjVlAXvHSi2QIZbIcrVudKqVpkl9hBKWyEU/661M+MjPLuU4BF
 ZCkU7nauf2B8QUSh8K0nKGkHPgZDeD8SNEVpvRcFow187AJz0BSvyOklX15Pr+rI
 7SXxUmVZ03yVBduorqCXwrhbQWxqdc2K1tQ06do8VTIjxUAwe3HyISl98ZFnrT1B
 /g4n+R8uV4QFxgNAPxjiD88BewIDAQABo4HTMIHQMAwGA1UdEwEB/wQCMAAwHwYD
 VR0jBBgwFoAUwR67pD8OE9+Bm75MYrLZur7VtrswKQYDVR0RBCIwIIIOdHNhMS5j
 ZXNuZXQuY3qCDnRzYTIuY2VzbmV0LmN6MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMI
 MD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jcmwuY2VzbmV0LWNhLmN6L1BlcnNv
 bmFsU2lnbmluZzIuY3JsMB0GA1UdDgQWBBRkK2hn4tgnpvS/JMiNhCqdneTm1zAN
 BgkqhkiG9w0BAQsFAAOCAQEAYnzrqDcaln6O6uALwwMlgUHIp3u6crLITzKFbPPi
 OKfzlmzsPNfU5kyi1vHS/ajReTNeJet02KGygIH4LB7pVwZKxx7xhQD6AK971Z6d
 rwDVoEYE2SB7PMcWgh+/mV90qJqgBUrVLFVExe91BkQONbNF81tzQXknovr2yWe5
 fYzYE6oJDGImoUmtN2lJRLZdS4TQbmfdSZDClwmraw2i4TAN6aCHrdST81GaIzwP
 bFAKMkgUOD8ynwJTbk8lk9hnO/uf3BFkmPClAmOlRHYRPmsWe2M2eQpBrYNoH0vw
 8SCFNE+MLMTzM1/dRjq9fnKb1pejxj3xqPF6WAojgAYnpw==
 -----END CERTIFICATE-----
 subject=DC = cz, DC = cesnet-ca, O = CESNET CA, CN = Personal Signing 2
 issuer=DC = cz, DC = cesnet-ca, O = CESNET CA, CN = CESNET CA Root
 -----BEGIN CERTIFICATE-----
 MIIETTCCAzWgAwIBAgIHAPTqVoKaNDANBgkqhkiG9w0BAQsFADBcMRIwEAYKCZIm
 iZPyLGQBGRYCY3oxGTAXBgoJkiaJk/IsZAEZFgljZXNuZXQtY2ExEjAQBgNVBAoT
 CUNFU05FVCBDQTEXMBUGA1UEAxMOQ0VTTkVUIENBIFJvb3QwHhcNMTgwNDE4MDky
 MDQ4WhcNMjgwNDIwMDkyMDQ4WjBgMRIwEAYKCZImiZPyLGQBGRYCY3oxGTAXBgoJ
 kiaJk/IsZAEZFgljZXNuZXQtY2ExEjAQBgNVBAoMCUNFU05FVCBDQTEbMBkGA1UE
 AwwSUGVyc29uYWwgU2lnbmluZyAyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
 CgKCAQEApKhbabfUBLMtC10PXFQe+hJI4wpJFNkYt3HRud0rZKmRqlcpPJvc4PLr
 9kEjXS+CP6Ut0UUkDvl686Mi7PsdxYFgDCfj0P694UA2SsGvBShL0vlZVkH19YFJ
 tyY1imP3B94r57+umqKEEr9qxu9nwToS8AB6Ead4zBPMSnHZvyFPuD9Lsc/WhcUb
 HnUvZN9jrrV4D6AjyvaBFPPcDVLjgiGoEE50PVMHPT5ZHpwTBTpBgL3zjE5fmxI4
 HU7aD0orO0pg0kmZrQa98bnnVb7Wp9HhYHc9tPhLMhi9UdTBb9zwQCaezJ0gnS5K
 iEAT5ZCYRUYlg82R07Z8k8UnHjczYQIDAQABo4IBDjCCAQowDwYDVR0TAQH/BAUw
 AwEB/zALBgNVHQ8EBAMCAQYwHQYDVR0OBBYEFMEeu6Q/DhPfgZu+TGKy2bq+1ba7
 MB8GA1UdIwQYMBaAFJ5BMOPD1U6Mg46jPMl/o20TXYQlMG0GCCsGAQUFBwEBBGEw
 XzAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AuY2VzbmV0LWNhLmN6LzA2BggrBgEF
 BQcwAoYqaHR0cDovL2NydC5jZXNuZXQtY2EuY3ovQ0VTTkVUX0NBX1Jvb3QuY3J0
 MDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9jcmwuY2VzbmV0LWNhLmN6L0NFU05F
 VF9DQV9Sb290LmNybDANBgkqhkiG9w0BAQsFAAOCAQEApoIA2/rStoUKnWC+qz3P
 AZLtDiyuUqs4i4Lb18loxE67QdP9nDZEzwHrB9Cr4oxN9cTutdUiwDIBQKuLx3tH
 r7TyuwcIYhHlW0+Ih+yUeyXEJlvSfR29M7SXY2axw4TWv4qOT2LKlFGxFqZx4OwN
 aVMUDSFVr3E5J4doIB2u/pLd+LH1QdsUXF1VhIa+Is/HMhC2JvmdnFqOCypdQrSA
 Ski6L8GRONF4SwzXg/glOQaw0QR69CjrYcogne1d/3Mxwr45MVkPwMJXscPKiRam
 SSTj7AJpyic0xbFBwGu+T7BP0NujkY/CW96UoELgcPsKoTAg7j6BhrWsjrfEaqtu
 7Q==
 -----END CERTIFICATE-----
 subject=DC = cz, DC = cesnet-ca, O = CESNET CA, CN = CESNET CA Root
 issuer=DC = cz, DC = cesnet-ca, O = CESNET CA, CN = CESNET CA Root
 -----BEGIN CERTIFICATE-----
 MIIEDTCCAvWgAwIBAgIJAIf3+gBzaRRPMA0GCSqGSIb3DQEBBQUAMFwxEjAQBgoJ
 kiaJk/IsZAEZFgJjejEZMBcGCgmSJomT8ixkARkWCWNlc25ldC1jYTESMBAGA1UE
 ChMJQ0VTTkVUIENBMRcwFQYDVQQDEw5DRVNORVQgQ0EgUm9vdDAeFw0wOTAyMjQx
 MzE2MDJaFw0yOTAyMjQxMzE2MDJaMFwxEjAQBgoJkiaJk/IsZAEZFgJjejEZMBcG
 CgmSJomT8ixkARkWCWNlc25ldC1jYTESMBAGA1UEChMJQ0VTTkVUIENBMRcwFQYD
 VQQDEw5DRVNORVQgQ0EgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
 ggEBAPeL9R8QFCBHw/PlWt2wBnx0cCSiNAhlI7HInrzGmtHK/9MJQJpmcoToq91R
 Y+hdo7sVddNqbz3F+oeiKavz3wpdCZJtaPI8Sv44OlCtnxeuw0LkSAAfG3maue7X
 I4jFqCU7/NxcoursXHDMCRLqeKHkast0b4i7d1KOdoc6hMNVaVc1UY/wyimM+Pbh
 XRW4+iwnmJXlIqCumWaVKF0b1F0WK2LV5TRonsoFNPdVHBU795ObAXRsXWfiKwNK
 CX85l3AO37UN1wbQ7UvCzE88jYOanRxL1AKezCa1ca8AohqbqoVVtrRPUTMrlXG3
 JOBfRaG0+LPXxHwQ9zCjvV/9kFcCAwEAAaOB0TCBzjAdBgNVHQ4EFgQUnkEw48PV
 ToyDjqM8yX+jbRNdhCUwgY4GA1UdIwSBhjCBg4AUnkEw48PVToyDjqM8yX+jbRNd
 hCWhYKReMFwxEjAQBgoJkiaJk/IsZAEZFgJjejEZMBcGCgmSJomT8ixkARkWCWNl
 c25ldC1jYTESMBAGA1UEChMJQ0VTTkVUIENBMRcwFQYDVQQDEw5DRVNORVQgQ0Eg
 Um9vdIIJAIf3+gBzaRRPMA8GA1UdEwEB/wQFMAMBAf8wCwYDVR0PBAQDAgEGMA0G
 CSqGSIb3DQEBBQUAA4IBAQB+vy9hAwzjgjYTnTwfxK03Ze/07GnmulUxUIPOagHJ
 vGQojnjN3BGnMoXNhQrhhCy1BfKt88sweN/ELkeOsgthbQ24lX7YdgPEPSwY2iIB
 E0NWxG87+z5hmfo+M69Q9WS8b5aSd4v5pSzT4+s6UW2lsddbdpnI4OwEEVdmj4e1
 w0trIAfPsFSKx5jMvC0KzoO04fSAjxTj2bn4orRVWlVGUYmQm/Gq0w//f84zox/g
 /XjE+kQ+eFOpNeeJC2Tpl04BByskoOw4LybIZ6iSdrUjoLgrK3R1geXo86Sx8QWE
 VVWM2+1UCVV3AMhYwQUbgasrEPkZ79od6exSUb+ZTpWc
 -----END CERTIFICATE-----
@@ -0,0 +1,212 @@
 -----BEGIN X509 CRL-----
 MIIkXTCCI0UCAQEwDQYJKoZIhvcNAQELBQAwYDESMBAGCgmSJomT8ixkARkWAmN6
 MRkwFwYKCZImiZPyLGQBGRYJY2VzbmV0LWNhMRIwEAYDVQQKDAlDRVNORVQgQ0Ex
 GzAZBgNVBAMMElBlcnNvbmFsIFNpZ25pbmcgMhcNMjYxMDA2MDIwMDA2WhcNMjYx
 MjA1MDIwMDA2WjCCIn0wGQIIUsGyPiz/JusXDTI1MTExMDEyNDAwNVowGQIITw/A
 FKF3fpkXDTI2MDIxNzEzMzkzN1owGQIIDwynQv3qEtIXDTI1MTExNjA4NTcwOFow
 GQIIecxHchhWqskXDTI2MDQyMDEyNDUyOFowGQIIVV3tvLyh5L8XDTI2MDcyMzA3
 NTcyNVowGQIIXRFf7C89RHYXDTI2MTAwMTA4MDI1MlowGQIIGujCnHtZ630XDTI2
 MDkwMjA4MzQyMVowGQIIBUjiaT1N8mQXDTI2MDgyMTE1Mzg0MVowGQIIYDtCkH3s
 XC0XDTI2MDgyMTExNTczMlowGQIIM7A6M+zGNH4XDTI2MDYzMDA4MjE1OVowGQII
 OD5YngzPhcwXDTI2MDIxOTA5NDg1MVowGQIId+3XWY9sLioXDTI1MDkxNzA3NTgw
 NVowGQIICIfH2gcNl5QXDTI2MDEyMDEyNTE1MVowGQIIJutbA2mO0VgXDTI1MTEy
 NTExMzM1MVowGQIIDo0+U9ypOjgXDTI1MTExMzExNTE0M1owGQIIYEs5r1CnAogX
 DTI2MDkwMjA3MzIyNlowGQIIJKXjMnO2IfgXDTI1MTAwMjE0NDUwMVowGQIIK+6H
 vtR7eOIXDTI1MTEwMzA1MDA1MFowGQIIOlm7aT+bfZgXDTI2MDQyMTEzNDIzOFow
 GQIIXZabGRIWI58XDTI1MTAyOTA4MzEzMVowGQIIKW7Gp7+sBHgXDTI2MDkxNTEx
 MDEyMFowGQIITd0Jmbynr3kXDTI1MTExMjA5MDMxMFowGQIIAZVn3opWO9oXDTI2
 MDIwNTE1NTIyOFowGQIIAVrqR/q/GakXDTI1MTEwMzExMTgxMVowGQIIJoRNmqNO
 InIXDTI2MDYyNjEwMDY0NVowGQIIKxDaf+wXG/oXDTI2MDExNTA2NDMyOFowGQII
 GmzSpNnbshUXDTI2MDEyMDE0MjAwMFowGQIIB4PmtchWAeIXDTI1MTEyNTEyMzQ0
 N1owGQIIFksemuGYxUcXDTI1MTExMzA5NTk0OFowGQIIE9Ta5gXasz4XDTI2MDEy
 OTExMzU0NFowGQIIcxsIctoQtkYXDTI1MTEyNDExMjYzM1owGQIIVX3z9Arb9KUX
 DTI1MTAxNDIwMTcwM1owGQIIDAG1ASPrGPYXDTI1MTAwMjExMTYxMlowGQIIFAlQ
 P6dnuUYXDTI2MDkyOTA4MTUzMFowGQIIamxYsWCOFVUXDTI2MDgxOTA4MTYyNlow
 GQIIfFxX/VTma4sXDTI1MTExMjExMzE0MlowGQIILwVIP3J189sXDTI2MDUxMTEy
 MjUwM1owGQIIIxs+jHqWkTQXDTI1MTExMTEzMzUxNlowGQIIVfTA3V4+7D0XDTI2
 MDQwODEzMzA0NVowGQIIBCuxCs4JMC8XDTI1MTIwMTE0MzI1NlowGQIIOM4eYtuK
 hJ8XDTI2MDkxODA2NTE0OFowGQIITABFkB6YQckXDTI2MDQwODA5MzQxNVowGQII
 T1L/qHpUyVkXDTI1MTAxNzEzMzIzNlowGQIIGAg0gJNBFAYXDTI1MTIwMzEyMjgx
 OVowGQIIFtVCvvIpkg0XDTI2MTAwMjA4NDEzMVowGQIId2VhmCxSlw8XDTI2MDMy
 NjEwNTMwMVowGQIIB87gZ6S0Zp4XDTI2MDIxNzA2NDIyMlowGQIICYvp2aXNSFMX
 DTI2MDcxMDEzNTUzMVowGQIIcVww7496D90XDTI2MDkyOTA3MzczOFowGQIIZf0W
 Ch+RCEQXDTI2MDMwMjEzNTEzMVowGQIITTEZBUpL138XDTI2MTAwMTEwMDkxM1ow
 GQIIZ9HgurBci7AXDTI2MDUxNjE3MDcyN1owGQIIa5JPqwwcEU4XDTI2MDczMDEw
 NTA0NVowGQIIUctU95q4yk4XDTI2MDkyNTA5MzEwMFowGQIIaKMLNuq6/awXDTI1
 MTIwOTE0NDc0OFowGQIIUKb9EfwiUTEXDTI2MDUxMzE0NTA0OVowGQIIFzQm2Skn
 62oXDTI2MDkzMDA4MzQyOFowGQIIOOy45PStQmIXDTI1MTAyODA2MzQwNVowGQII
 Hu6J5L24masXDTI1MTAwMTE3MDcyM1owGQIIG9ycdVMY5DoXDTI2MDIwOTE1MzAw
 NlowGQIIe0FU8xTSe6UXDTI1MTEyNTEzMjUwNlowGQIIA4I0jOjTUDsXDTI2MDEx
 NTE3NTczMlowGQIIY0LCGujlTHMXDTI1MTExNjA5NTM1OFowGQIId2lhU9WPDO4X
 DTI2MDkwNDEzMTI0OFowGQIISVcZMqymLEsXDTI1MTIwMTEzNTgwOFowGQIIIpoY
 6WcirmAXDTI2MDcyMDA5MzI0MFowGQIIaaNO/2t9rGYXDTI2MDEyMDEyNDMzMlow
 GQIIT3neNOCak34XDTI1MTAwMjEwMTk0OVowGQIIR77EFOHtwf8XDTI2MDIyNTEy
 NTIzNFowGQIIdZtvgrPtNp0XDTI2MDEzMDA3MzQ1N1owGQIIH5lkBrVvYt8XDTI1
 MTAwMjEwMjI0NFowGQIIE4KD2RBnOYwXDTI2MDMwOTEyMTMyM1owGQIIOnfUn2uN
 x80XDTI2MDkwOTExMzc1NFowGQIIAydQ4+9veGQXDTI2MDIwNDExNDMxN1owGQII
 QU7JtncblbsXDTI2MDUyNjA4NTk0M1owGQIIB4tWeYrmRNkXDTI1MTIxNjEyMzgx
 NVowGQIIMehdRmqnb04XDTI1MTEyNDA5NDEyMFowGQIIJvAhg2gMLD8XDTI1MTAw
 MzE3MzExOFowGQIIc0zuTh9Y1H0XDTI2MDIxNjExMzYyOVowGQIII88pbZ4oYiMX
 DTI1MTIxMDEyMjEwOFowGQIIEQUpmz/jbzoXDTI2MDQyOTIzNDAzOFowGQIIOQLB
 tHDRqpAXDTI2MDkwODA4MDY1OVowGQIIUHcDwFGr/FgXDTI2MDgwMzE4NTIxNVow
 GQIIa5Qzz2cMheYXDTI2MDYxMTA2NDM0NVowGQIIHlQxCgBSP1oXDTI2MDUyMDA1
 MTgwNVowGQIIbKE+rocZexQXDTI1MTEwNDA3NTEyOVowGQIIf0uUc6eaVsAXDTI2
 MDIwNjA4MTU1OVowGQIIY+eb3zFca1MXDTI2MDcxNzEzMTAyOFowGQIIE0bdhdft
 AUIXDTI1MTEyNjA3MzgxOFowGQIIT2xxXPFZRbYXDTI2MDEyMDEzMzU0NVowGQII
 UkplZOj2P2MXDTI2MDYxNjA5NDIwOVowGQIIYn42KDa3L/kXDTI2MDcxNjE0MDM1
 M1owGQIIInNDh7IsXhcXDTI2MDQxNjExMDMxN1owGQIICKAO9LVSvaAXDTI2MDkx
 NTA5NDc0OFowGQIIZO8YVuy97SQXDTI1MTAwMjExMTAyN1owGQIIJ+Z6wziRjJ4X
 DTI1MTAwMjExMTYwN1owGQIIIEFHTk7F1gsXDTI1MTEyMDA5NTcyN1owGQIIPko+
 m2Vy3McXDTI2MDYyOTA5MTI1NVowGQIIIDwyl8gVSMkXDTI1MTEyMTIwNDUxOVow
 GQIISdcQIZXutooXDTI2MDQxMzEzNDEzM1owGQIIbuT4JiU8OFAXDTI1MTIwMjE1
 MTQ1MFowGQIIY+4uKoNK84UXDTI1MTAxNjA3NTUyOVowGQIIZ0QawiA6/iYXDTI2
 MDkyOTA4NTgwOFowGQIIOHuIUJusOhcXDTI2MDMyMDE2MDI1OVowGQIIcqGOXGrM
 RdMXDTI2MDcwMzEyNDgxNFowGQIIPne+2s5z8S8XDTI2MDkyMjEzMzAyNVowGQII
 eZiJN0CAcDsXDTI2MDEwNzA5MjA0N1owGQIINN3rroiSTEQXDTI2MDcxNTExNTcz
 MlowGQIIfs/AxFNTT28XDTI2MDUxODA4MzEwOFowGQIIQzxcao59hcYXDTI1MTEw
 MTA5MTU1MVowGQIIEH9H99BhDQYXDTI2MDYyNTE1MzE1OFowGQIIb8+2DdusVG8X
 DTI1MTExMDEwMTAzNlowGQIIae9A8zz6b7sXDTI2MDQwMTA2Mjg1OVowGQIIINVu
 DnOezS0XDTI2MDcyMzA3MzAzMlowGQIIFeYu/X8nbsMXDTI2MDkxMTA2Mjk0NFow
 GQIIdESSq793u1gXDTI1MTEwMjEwNDEyOFowGQIIahLWmQxae+EXDTI2MDUyNzA2
 MjExNlowGQIIZxPdOyDDMRkXDTI1MTEwNDA5MDMxMVowGQIIXVnUTY2XtIUXDTI1
 MTEwNTE2MDczNVowGQIIQaWn/fkln5sXDTI2MDEyMDEzMzUwMFowGQIIMCCITuVM
 XfQXDTI2MDYyOTExNTcxN1owGQIIAzQNKMYpOBsXDTI1MTAwNzEyMTAyNVowGQII
 EfMNg6J5K3wXDTI2MDUxMTEyMDMyN1owGQIIIU/n2JF2+3MXDTI2MDUxODA2MDYx
 NVowGQIIFQNENN9WUfMXDTI2MDQwNzE0MDAyMlowGQIIY9pnje/3WZAXDTI1MTAx
 MDE1NTUyNlowGQIIcsA/9oSy8aMXDTI1MTEyNDA5MjI0MVowGQIIChL5tS0PkiwX
 DTI2MDUwNTA3NTAyMVowGQIIUIgq5xBKhWIXDTI2MDEwNTA4NDcwMlowGQIIJPwR
 OLdENO4XDTI2MDkwMzE0MDYyNVowGQIIdepPNvs6g98XDTI2MDkxNTA2NDkyOFow
 GQIIfieK/LJt8AEXDTI1MTAyMTA4MjEzMVowGQIIVzBSR0ukBpwXDTI2MTAwMjA4
 MjQ0MlowGQIIZ9YSiFi3cu4XDTI2MDcwODA5MTMyMlowGQIIHiaiVUPFDsEXDTI1
 MTIxMDA5NDMzNlowGQIII1oP5Y8l2dQXDTI2MDcyMDE5MTEwNVowGQIIWvB++OKF
 j10XDTI1MTExNjA5NTUzM1owGQIIL+WkH6xWigMXDTI1MTExMzA3Mzc1N1owGQII
 V5PIi1ZKXToXDTI2MDgzMDEyMjY0NFowGQIIJBPSP3mmzdoXDTI2MDEyODEyMDU1
 M1owGQIIBoDh/2IUwekXDTI1MTAwODEyMTg0OFowGQIIJm0LoJ/sROoXDTI1MTEw
 NjEwNTcyMVowGQIIYk5Rp+sjneYXDTI1MTAxNTEwMjAxNlowGQIIFbGHEEin5gsX
 DTI1MTAyMDEyNDMwNVowGQIINFxmpvf9uvcXDTI2MDgyODA3MTcxNFowGQIICHPV
 WIGIzSAXDTI2MDIxMjE5MTcwNVowGQIIKgqZH/08S7YXDTI2MDYwODEyMzcxNVow
 GQIIMdxioTVehjcXDTI2MDkyOTIwMDQ0MFowGQIIJhvqUPFve9oXDTI1MTIwODEw
 NDIyNFowGQIIOoORuebTtoIXDTI2MDExNTA2Mzc1NlowGQIIQVFDkFsxixsXDTI1
 MTAxNzEzMDMzOFowGQIIe6XyIg4kQvQXDTI1MTAwNjEyMDY1NVowGQIIR8l9MlTb
 l8QXDTI2MDIwMzEwMTkwOVowGQIIQ1dbYpVf80YXDTI1MTEyNDEwNTg0MFowGQII
 VQaTTVNaI0sXDTI2MDkwODEwMjY1M1owGQIIF0SXS58bT6MXDTI2MDQxMjA5MTg0
 MVowGQIICewuBOmmrTkXDTI2MDYyNTE1MjUyNlowGQIIPwH9hRRTHGkXDTI2MDIy
 MDA3Mjk0OFowGQIIYX8M+IhEwecXDTI2MDcxNzEzMDMzMFowGQIITnEpmqbAiVoX
 DTI1MTEyNDA5MzgwNlowGQIIaXKrPZxiyzIXDTI1MTIwMjExNDI0MFowGQIISMLv
 5/HdOaYXDTI2MDUxNDA5MjgxNlowGQIINUnpr0mtGf0XDTI2MDkyOTEyNDEwNVow
 GQIIM/9DyAgpaW8XDTI2MDUyNjEwMjE1NFowGQIICMhXhunT/L4XDTI2MDMyMDA3
 NDYxMVowGQIIAq0/Sx4VsaQXDTI1MTAxNzEzMDUzOFowGQIIKnAiiKgQxjIXDTI1
 MTEyNjE5MjU0OFowGQIII5dyjkClMl8XDTI2MDQzMDA5MjEwMVowGQIIF+nqKLg9
 46QXDTI1MTAwODEwNDM0OVowGQIISjEr35VqGuEXDTI2MDQwODEzMjUwN1owGQII
 fAhULLqErhcXDTI2MDUyMDA1MTYwNVowGQIIO5Jo7pem3Q4XDTI1MTAxNDEwMDAz
 OFowGQIICDq9lZHqOzEXDTI2MDYxNTA2MzUwNFowGQIIDCUOwLwkaUoXDTI1MTEy
 NzEwMjc0NlowGQIIfKxiawqtmb0XDTI2MDUxMjEwNTIwM1owGQIIMpvCr17+/+sX
 DTI2MDMwMjA3MjkzOVowGQIIAju3lBGAW5oXDTI2MDMwMzExMTgxM1owGQIIPIDp
 2Q+/X5UXDTI2MDkwOTA1MzAwMVowGQIIXaQU/3tt8lsXDTI2MDQwODEzMjQxOFow
 GQIIN9p2LMvinVsXDTI2MDIxNzEyMDgxNVowGQIIJqdWkZ/LQBwXDTI2MDkwNzE3
 NTY1MFowGQIIHsYIyInWvQ4XDTI2MDQwNzA2MjExNFowGQIIIjIBiqzq3EEXDTI2
 MDgyODA3MDkzOFowGQIIS5AoYpCEHlgXDTI2MDYyMjA2Mjg0NVowGQIIBFZEwHfA
 MfQXDTI1MTIyMjEzMDc0NVowGQIIH3WFAgIY0ccXDTI2MDYwMjA3MzIzMlowGQII
 CDrAXCb6Sk4XDTI1MTAwMjE5MjEyMFowGQIICz3QKkLfm94XDTI2MDkwMTE2MzQ0
 MVowGQIIXaZvBFfd2o8XDTI2MDYwNTA4NTI1M1owGQIIOBX2e14+XB8XDTI2MDMy
 NDA4MzEyMVowGQIICN+4q7Ids2wXDTI2MDEyNzA4MDUxN1owGQIIF2P1MyHmx1AX
 DTI1MTAxNDEwMTE1MFowGQIIMYFqigt7RGwXDTI2MDUwNTA3MzQzMFowGQIIOrdl
 8wsUC2QXDTI2MDYwNTA4NTMzOFowGQIILFeZfAqZ8tcXDTI1MTAwMzE5Mjg1NVow
 GQIIT/BwMpYlRrUXDTI1MTEyODExMTkxMlowGQIIDA3wK+KyvLIXDTI1MTAyMzA5
 MTM0MVowGQIIe+f8p1lmFbYXDTI2MDgwNDEwMTE0M1owGQIID0Dv1PcLdgYXDTI2
 MDEwNzEzNTEyNVowGQIIeJYpUVVfeucXDTI2MDIxNjExMzQxMFowGQIIf+bc2kQd
 2E4XDTI2MDYyOTA5Mzg0MFowGQIIJkJ2C4Jc8MwXDTI2MDYxMTExNDMyM1owGQII
 cVgdw0yfWVgXDTI2MDIxODEwMjYyNVowGQIIDSPges7W4fYXDTI2MDQwODEzMzMz
 MFowGQIIJfSYiD+gEQ0XDTI1MTAxNTE0MjMwNlowGQIIIFQYctIx5v0XDTI1MTAx
 MzE4MDU0MVowGQIILOysJ8mMgEkXDTI2MDgyMTEzNDc1OVowGQIIFNXghew2E4kX
 DTI2MDkxNTEzMzA0MlowGQIIMXEiFsZRp+gXDTI1MTEyMTExNDEzNlowGQIIJ/Oh
 mzp/1RAXDTI2MDUxMTExNTMzMVowGQIIHqkOq3IIUjwXDTI1MTAxOTE4MjQxNFow
 GQIICC57uK53vpUXDTI2MDQzMDA3MjEyOVowGQIIUriOiPI7brIXDTI2MDkwODEw
 MjY0M1owGQIIJj8YeRYbJ8sXDTI1MTIwMTE1MTYyMlowGQIIUTnE3mjq0JAXDTI2
 MDMxMTE0MjkzOVowGQIIaWtEWdqPoSUXDTI1MTAwNjEyMzkwN1owGQIIKRrO+Rdt
 z2wXDTI1MTEwNDA3NTQ1MVowGQIIaqVHEVweOioXDTI1MTIxOTE0MTUzN1owGQII
 KvhJaikszZAXDTI1MTAyOTA5Mjc1M1owGQIIWvHgJlsly3cXDTI2MDUyNzE2NDYy
 MVowGQIIeGn+quSTe/8XDTI2MDcwMTA3NDU1OFowGQIIfJzwjfsA564XDTI2MDcw
 OTA3NDAyMFowGQIIDiNdsncdIucXDTI2MDYyMjE2NTQxMVowGQIIO7Z51f5KA4EX
 DTI2MDIxODA3MDUyMlowGQIIJf7gfEzNKGAXDTI2MDUyMTA2NTczOVowGQIIHWIQ
 1PKmJX8XDTI1MTEwMjEwNTU0NVowGQIIec6YCIoC2boXDTI2MTAwNTE1MTQzOVow
 GQIIbUPAx+hYs4YXDTI2MDYxOTEzNTkyMlowGQIIcxCrjzdNOrEXDTI2MDcxMzEy
 MTA0OVowGQIIEaDZoqb9FwgXDTI2MDUwNjA1MzUwMlowGQIIHZvS79h/NjsXDTI1
 MTIwMjExMjU0MVowGQIIF509TpI3YtYXDTI1MTAxNTExNTAwNlowGQIIT0fITGJb
 2y4XDTI1MTIwMzIwMzEyMFowGQIIZdUz8joqRaUXDTI2MDUyNzE4NTU0MVowGQII
 YqAK5gXV4HoXDTI2MDcwNjE0MDcyNlowGQIIc0Y8ScuuFnkXDTI2MTAwNTA3MDIw
 NlowGQIId1PxAXNaNP4XDTI2MDczMTA2NTcyMFowGQIIWtOmzd6TtmcXDTI2MDky
 OTEzMTk1MFowGQIIJZvXfQk735YXDTI2MDkwMjA4MjcyMVowGQIIUIOvDtJU1EsX
 DTI1MTIxNTIwMDE1OVowGQIIEf94P9BJ9t0XDTI2MDUyOTE1MTczOVowGQIIKf4w
 R6Zi7zoXDTI2MDUxODA2MTM1M1owGQIIWXZCBL6+pdQXDTI2MDkxNjEwNDMwNFow
 GQIIGoqYNwadV1AXDTI2MDgwMzA3MTUxOFowGQIIXg/hSqYdW7MXDTI2MDcyNzE5
 NDIyM1owGQIIAw3RjkFZXGQXDTI2MDgzMTEyMjEyNVowGQIIAoEHWCIBGMQXDTI1
 MTExNjEwMzQxNVowGQIIHDecbnOolr4XDTI1MTAxMzE4MDYzMlowGQIIMenjZOib
 oNYXDTI1MTAyMDEwNDU1OFowGQIIIofwKKiA7PkXDTI2MDcyMzE0MjkyMlowGQII
 C5Zs+eVmybcXDTI1MTIwMzIwMzIwM1owGQIINDo7QIrWSasXDTI2MDEwNzE3Mjgz
 M1owGQIIZTuIj/XyoSMXDTI1MTAwMzE3MzExMFowGQIICp+OZ42EQlQXDTI2MDUy
 NTA4NTE0MVowGQIIEAgP/rBzX70XDTI2MDkwNzEyMzU1OFowGQIIO5FuhGQDXhIX
 DTI2MDcyNzIxNDExNVowGQIIaG/atHNa4XwXDTI2MDgyNDA5MjQwNVowGQIIAz2Y
 JX4o2/cXDTI1MTAxNzEzMDQyNlowGQIIQ7Lm/pDJi6oXDTI2MDQyMjAwMzMzOFow
 GQIITsttM/M7Wm0XDTI1MTEyMjAyMjg1MFowGQIIYaLHAWjfw6UXDTI1MTEyNzA4
 NTMzNVowGQIIJQQmG3y7XQkXDTI1MTEwNzEzMjIzOFowGQIIPfNRQmx8pQMXDTI1
 MTEwNjIxNDI0OFowGQIIDwU7bDEsDTwXDTI2MDYxNTEwMjIzNlowGQIIcHmCzh6K
 LBcXDTI2MDcxMDA4MDAyOFowGQIIAjbty4b3dC0XDTI1MTIxNzIyMzIzN1owGQII
 GIJhCvC8vyAXDTI2MDEyMDEzMzgxNlowGQIIDHBUM+MTvYoXDTI2MDIxNjExMzky
 OFowGQIIfWUVsXT6Hg0XDTI1MTEyNzA5MjczOFowGQIIRPDVeldIuaoXDTI1MTAy
 MzE2NTYxOFowGQIINz1uhwu5YJUXDTI1MTExMTA3NTEwM1owGQIIEJ3rriTZkb8X
 DTI2MDYxMTA2MzUzMVowGQIIBTznbZIbRlMXDTI2MDIxNjExMjYzOVowGQIIPagq
 2PjakYwXDTI2MDkxNTA2NTEwNFowGQIIa+FgHerm4OUXDTI1MTEwNTE2MDU1M1ow
 GQIISN+7oBf9vewXDTI2MDcyMzE1MzUzM1owGQIIXLX1jnsLE3UXDTI2MDMyNDE2
 MTc0OVowGQIIMr7rejBNLDIXDTI1MTExOTIxNDMzM1owGQIIDz3I6d3bGUMXDTI2
 MDQwNzA3MjIzN1owGQIIcTuYpxJBFB4XDTI2MDYxODEwMjEwM1owGQIIBMHU2Ko9
 BFkXDTI1MTIwMTEzMzQxMFowGQIICC27XX0Wt8kXDTI2MDIxNjExMzgyM1owGQII
 B4uz1azIUP8XDTI2MDYyMjExNTIwM1owGQIILJPWhJFnnoMXDTI2MDEyMDEzMTI1
 NVowGQIIfKXkjacqUUsXDTI2MDExMjIyMTQwNFowGQIIWPS4HpRvqbAXDTI1MTEy
 NjA3NTczOFowGQIIPC3/T3HH1wsXDTI1MTAyOTE0MjcwOVowGQIIMUiNWSoAQQUX
 DTI1MTEwNDE1MjEzNFowGQIIOYgtJBa781EXDTI1MTIxNTIwMTkwNVowGQIIOJ1q
 lfI0LHEXDTI2MDgwNzA4NTUxM1owGQIIXXq99FZW1LQXDTI2MDkwMjA4MzMyM1ow
 GQIIKWMCH/ST5o4XDTI1MTAxOTE5MzYzMlowGQIIJEAhg56jt3UXDTI2MDYyODEy
 MDM0OFowGQIIAXqYKxpnuQkXDTI2MDUyNjA3MDk1OVowGQIIVFgu3Mkb1u4XDTI2
 MDQwOTEzNDEwNFowGQIIXqV+TMawcKYXDTI2MDYyOTE1NDI0M1owGQIIVYQxxZkv
 1QYXDTI2MDkwNjE4NTY0N1owGQIIBd5VPxN4OBoXDTI2MDIyNDE0NTExNFowGQII
 RLeFdPjDIXsXDTI2MDkxODA2NTIwNFowGQIIBmTK5B6jGAoXDTI2MTAwNTE0MjEz
 MFowGQIIEOGGPdufvEYXDTI1MTEyMTA3MDkwMVowGQIIRXwBTXN2qCUXDTI1MTAy
 MDA2NDM0MlowGQIIZH4V1WQhVZ4XDTI2MDEyODEyMDcyN1owGQIISaIxfVkLyZwX
 DTI2MDYxMTEzNTg0M1owGQIIC+vrr179GvQXDTI2MDMwMjEzMTYyN1owGQIIHcoo
 YDhiwg8XDTI2MDcwODEyMzc1NFowGQIIXPgO1HmiSpkXDTI2MDQyNDEyMjY1Mlow
 GQIIY4R7/Ekn5icXDTI1MTEwNTEyMTUyNVowGQIIH5v/d93xrRsXDTI1MTAyMDEw
 MzAzNFowGQIIelGp2TRbOuEXDTI2MDkxODExMDkzOVowGQIIWKSvQc1n8QYXDTI2
 MDgwMzA3MDc1N1owGQIITbE23PsSk5sXDTI2MDExOTE0NDExMFowGQIIBiqRK3nP
 Fz4XDTI1MTEwNDE0MjY1NFowGQIIL7k5jXdSOZkXDTI2MDUxOTA5NDY1NVowGQII
 SwRIoQccT5gXDTI1MTAwMTEzMTk1NFowGQIIO+0td/KaNkMXDTI2MDQxNTExMDEw
 NlowGQIIdhWgkhkuiycXDTI2MDUyNTA5NTkzMlowGQIIKraDl0ZldrQXDTI1MTAw
 ODEyMjQ0OFowGQIIJxE9bkjeCksXDTI2MDYxNTEyMTM1OFowGQIIFva6DRqvZlcX
 DTI2MDYyMjEzNTUzOVowGQIIdG7nw0wvSPYXDTI1MTEyNzA4NTYyNlowGQIIN1mH
 3g49lsgXDTI2MDUyNjEzNDg0M1owGQIIWOLdx6gv2JIXDTI2MDEwNTA3MzU1MVow
 GQIIKXVDQs5LNZcXDTI2MDkxMDA4MTExOVowGQIIIgd6b+1OVBoXDTI2MDQyOTEz
 MTYyNlowGQIIYADlz2qkbywXDTI1MTEwNTE1MDg0NVowGQIIaW/7YSEuYiMXDTI2
 MDgyMDExNTQzNFqgMDAuMB8GA1UdIwQYMBaAFMEeu6Q/DhPfgZu+TGKy2bq+1ba7
 MAsGA1UdFAQEAgIkETANBgkqhkiG9w0BAQsFAAOCAQEAFFutgiPbpO00CErMmyji
 QzQHVOh3L312M3on35mJQ4wM8jGkQeOMwxFDtQk0OAg1VZlHClyzKdEF0Uw/JmfZ
 g8qJ1HC328Gbo/Y17Ypq2A6B2hmJjwIQg+w182FLMQzRWjQiNBtAQ4AGqe8GHf3r
 QTUJZL3KR1OIwXPZv37RbG6AP5NHs6rpz+Nf7qZTazAETeHme88KCy/hNBqyqB4E
 MjE3JfqG9p33XZGbmtpf5a6sNxQesrp+5R9h1YcNPVVuRwh8rqGlDMgkb7ftDfqf
 Th7ntjBsk8Km0kliQOgir8i6GC/BBkPlru+bGKbZEo26B4ddthjWclYj6oa27gin
 xA==
 -----END X509 CRL-----
 -----BEGIN X509 CRL-----
 MIICSTCCATECAQEwDQYJKoZIhvcNAQELBQAwXDESMBAGCgmSJomT8ixkARkWAmN6
 MRkwFwYKCZImiZPyLGQBGRYJY2VzbmV0LWNhMRIwEAYDVQQKEwlDRVNORVQgQ0Ex
 FzAVBgNVBAMTDkNFU05FVCBDQSBSb290Fw0yNjAzMTExMTAyMTNaFw0yNzAzMTIx
 MTAyMTNaoIGgMIGdMIGOBgNVHSMEgYYwgYOAFJ5BMOPD1U6Mg46jPMl/o20TXYQl
 oWCkXjBcMRIwEAYKCZImiZPyLGQBGRYCY3oxGTAXBgoJkiaJk/IsZAEZFgljZXNu
 ZXQtY2ExEjAQBgNVBAoTCUNFU05FVCBDQTEXMBUGA1UEAxMOQ0VTTkVUIENBIFJv
 b3SCCQCH9/oAc2kUTzAKBgNVHRQEAwIBGjANBgkqhkiG9w0BAQsFAAOCAQEAllsy
 RAg1qH/efzMXW4ZE1+1lB8GOVayA/ZoqJrXg6eTy0aruW64V/V7MDCAfdTPOlUHE
 s1NkgBgJYMeXWHd8tkTAiJv+50wbHwsJECr0a2KZ5WBmdOYzhWQHaM1AWGYPtGoj
 uU53UL0JOoHi/Gm4tlHfGSneWbmQmBDzrN/C/lZ+QTxY7ZJK02uLfbco60ktVoYA
 N7g8SghtlzwwICsM06N6QjWo0OK61HVWhDBWeyByEK9fk5ewGIEgV3wJhwZeLJT0
 7e2iOwIwo8+SNc77FS+aaFOU+Fgd89r1MCnuy9/sWKc9Rpmm4cSd11dLZhlRXGfR
 GXKb2wujaj8Ha0iRGQ==
 -----END X509 CRL-----
@@ -0,0 +1,18 @@
 -----BEGIN X509 CRL-----
 MIIC8DCB2QIBATANBgkqhkiG9w0BAQ0FADCBlTERMA8GA1UEChMIRnJlZSBUU0Ex
 EDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEiMCAG
 CSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3Vlcnpi
 dXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFFw0yNjA5MTgxMDMwNTVa
 Fw0yNzA5MTgxMDMwNTVaoA8wDTALBgNVHRQEBAICEAAwDQYJKoZIhvcNAQENBQAD
 ggIBABHK9i209Jx6iSu0+YIgeZLo1X0I8CLw5pnWopQIwd40PBbjLqvY3KjFUj8b
 AAHzYqrmVDFvBA4VXJB+uzf7L8JeveipwHCnoGERwczEI4gNWyYENeUW9hATDrr6
 BsIrueXmgqDZjhAW0impc8vaPxLLtNWJIGnl2KR5aaYqKyWqdlR9zBzvp6qNAPJN
 xTxLHA833ddFq8LVXdYk87ACQEymof/wxBF9aTA/qYyEptFIAWgeRcoWxigA+2IB
 MjVfGGB2dop5Oo9xe6ZUu6wOJmJS+nMEDvyzMeoGLU9QtEZOo+W6cF4/+si1DH0B
 VwU2JgHOc7VKZwOWE9mlOrL9+b/1IHSghg7RsQ3+HE0Puo/PGDAKjJcOa6TOvhSo
 eRMnOTV/axmFsv3/tvrsymVJ/phoYoHZaXkaoGugNwDzVMTTVx6dSpbd/n8JFDCh
 KbOs0aNB1ZBnWMw5HwUxV+dGXjyZOib+M0W2SdMGrXycxG70M7Vg/ZWYjQboE6Sp
 o1hjUCONq3QdU3L5luy9vUatp6cgSj58w20CQRkaibW5S/8fjfYCsePG7hRHO5ht
 YX5UU8n61kkgq5n8w3VF9G3khCEmiK+0/5YXDmwQ71UM0OZkYaKBgaQt8+HC2X12
 dUGrgUfytqHQtKTZsKbhpRSGC1oj1TGIyENG9lh7307RsARx
 -----END X509 CRL-----
@@ -0,0 +1,212 @@
 -----BEGIN X509 CRL-----
 MIIkXTCCI0UCAQEwDQYJKoZIhvcNAQELBQAwYDESMBAGCgmSJomT8ixkARkWAmN6
 MRkwFwYKCZImiZPyLGQBGRYJY2VzbmV0LWNhMRIwEAYDVQQKDAlDRVNORVQgQ0Ex
 GzAZBgNVBAMMElBlcnNvbmFsIFNpZ25pbmcgMhcNMjYxMDA2MDIwMDA2WhcNMjYx
 MjA1MDIwMDA2WjCCIn0wGQIIUsGyPiz/JusXDTI1MTExMDEyNDAwNVowGQIITw/A
 FKF3fpkXDTI2MDIxNzEzMzkzN1owGQIIDwynQv3qEtIXDTI1MTExNjA4NTcwOFow
 GQIIecxHchhWqskXDTI2MDQyMDEyNDUyOFowGQIIVV3tvLyh5L8XDTI2MDcyMzA3
 NTcyNVowGQIIXRFf7C89RHYXDTI2MTAwMTA4MDI1MlowGQIIGujCnHtZ630XDTI2
 MDkwMjA4MzQyMVowGQIIBUjiaT1N8mQXDTI2MDgyMTE1Mzg0MVowGQIIYDtCkH3s
 XC0XDTI2MDgyMTExNTczMlowGQIIM7A6M+zGNH4XDTI2MDYzMDA4MjE1OVowGQII
 OD5YngzPhcwXDTI2MDIxOTA5NDg1MVowGQIId+3XWY9sLioXDTI1MDkxNzA3NTgw
 NVowGQIICIfH2gcNl5QXDTI2MDEyMDEyNTE1MVowGQIIJutbA2mO0VgXDTI1MTEy
 NTExMzM1MVowGQIIDo0+U9ypOjgXDTI1MTExMzExNTE0M1owGQIIYEs5r1CnAogX
 DTI2MDkwMjA3MzIyNlowGQIIJKXjMnO2IfgXDTI1MTAwMjE0NDUwMVowGQIIK+6H
 vtR7eOIXDTI1MTEwMzA1MDA1MFowGQIIOlm7aT+bfZgXDTI2MDQyMTEzNDIzOFow
 GQIIXZabGRIWI58XDTI1MTAyOTA4MzEzMVowGQIIKW7Gp7+sBHgXDTI2MDkxNTEx
 MDEyMFowGQIITd0Jmbynr3kXDTI1MTExMjA5MDMxMFowGQIIAZVn3opWO9oXDTI2
 MDIwNTE1NTIyOFowGQIIAVrqR/q/GakXDTI1MTEwMzExMTgxMVowGQIIJoRNmqNO
 InIXDTI2MDYyNjEwMDY0NVowGQIIKxDaf+wXG/oXDTI2MDExNTA2NDMyOFowGQII
 GmzSpNnbshUXDTI2MDEyMDE0MjAwMFowGQIIB4PmtchWAeIXDTI1MTEyNTEyMzQ0
 N1owGQIIFksemuGYxUcXDTI1MTExMzA5NTk0OFowGQIIE9Ta5gXasz4XDTI2MDEy
 OTExMzU0NFowGQIIcxsIctoQtkYXDTI1MTEyNDExMjYzM1owGQIIVX3z9Arb9KUX
 DTI1MTAxNDIwMTcwM1owGQIIDAG1ASPrGPYXDTI1MTAwMjExMTYxMlowGQIIFAlQ
 P6dnuUYXDTI2MDkyOTA4MTUzMFowGQIIamxYsWCOFVUXDTI2MDgxOTA4MTYyNlow
 GQIIfFxX/VTma4sXDTI1MTExMjExMzE0MlowGQIILwVIP3J189sXDTI2MDUxMTEy
 MjUwM1owGQIIIxs+jHqWkTQXDTI1MTExMTEzMzUxNlowGQIIVfTA3V4+7D0XDTI2
 MDQwODEzMzA0NVowGQIIBCuxCs4JMC8XDTI1MTIwMTE0MzI1NlowGQIIOM4eYtuK
 hJ8XDTI2MDkxODA2NTE0OFowGQIITABFkB6YQckXDTI2MDQwODA5MzQxNVowGQII
 T1L/qHpUyVkXDTI1MTAxNzEzMzIzNlowGQIIGAg0gJNBFAYXDTI1MTIwMzEyMjgx
 OVowGQIIFtVCvvIpkg0XDTI2MTAwMjA4NDEzMVowGQIId2VhmCxSlw8XDTI2MDMy
 NjEwNTMwMVowGQIIB87gZ6S0Zp4XDTI2MDIxNzA2NDIyMlowGQIICYvp2aXNSFMX
 DTI2MDcxMDEzNTUzMVowGQIIcVww7496D90XDTI2MDkyOTA3MzczOFowGQIIZf0W
 Ch+RCEQXDTI2MDMwMjEzNTEzMVowGQIITTEZBUpL138XDTI2MTAwMTEwMDkxM1ow
 GQIIZ9HgurBci7AXDTI2MDUxNjE3MDcyN1owGQIIa5JPqwwcEU4XDTI2MDczMDEw
 NTA0NVowGQIIUctU95q4yk4XDTI2MDkyNTA5MzEwMFowGQIIaKMLNuq6/awXDTI1
 MTIwOTE0NDc0OFowGQIIUKb9EfwiUTEXDTI2MDUxMzE0NTA0OVowGQIIFzQm2Skn
 62oXDTI2MDkzMDA4MzQyOFowGQIIOOy45PStQmIXDTI1MTAyODA2MzQwNVowGQII
 Hu6J5L24masXDTI1MTAwMTE3MDcyM1owGQIIG9ycdVMY5DoXDTI2MDIwOTE1MzAw
 NlowGQIIe0FU8xTSe6UXDTI1MTEyNTEzMjUwNlowGQIIA4I0jOjTUDsXDTI2MDEx
 NTE3NTczMlowGQIIY0LCGujlTHMXDTI1MTExNjA5NTM1OFowGQIId2lhU9WPDO4X
 DTI2MDkwNDEzMTI0OFowGQIISVcZMqymLEsXDTI1MTIwMTEzNTgwOFowGQIIIpoY
 6WcirmAXDTI2MDcyMDA5MzI0MFowGQIIaaNO/2t9rGYXDTI2MDEyMDEyNDMzMlow
 GQIIT3neNOCak34XDTI1MTAwMjEwMTk0OVowGQIIR77EFOHtwf8XDTI2MDIyNTEy
 NTIzNFowGQIIdZtvgrPtNp0XDTI2MDEzMDA3MzQ1N1owGQIIH5lkBrVvYt8XDTI1
 MTAwMjEwMjI0NFowGQIIE4KD2RBnOYwXDTI2MDMwOTEyMTMyM1owGQIIOnfUn2uN
 x80XDTI2MDkwOTExMzc1NFowGQIIAydQ4+9veGQXDTI2MDIwNDExNDMxN1owGQII
 QU7JtncblbsXDTI2MDUyNjA4NTk0M1owGQIIB4tWeYrmRNkXDTI1MTIxNjEyMzgx
 NVowGQIIMehdRmqnb04XDTI1MTEyNDA5NDEyMFowGQIIJvAhg2gMLD8XDTI1MTAw
 MzE3MzExOFowGQIIc0zuTh9Y1H0XDTI2MDIxNjExMzYyOVowGQIII88pbZ4oYiMX
 DTI1MTIxMDEyMjEwOFowGQIIEQUpmz/jbzoXDTI2MDQyOTIzNDAzOFowGQIIOQLB
 tHDRqpAXDTI2MDkwODA4MDY1OVowGQIIUHcDwFGr/FgXDTI2MDgwMzE4NTIxNVow
 GQIIa5Qzz2cMheYXDTI2MDYxMTA2NDM0NVowGQIIHlQxCgBSP1oXDTI2MDUyMDA1
 MTgwNVowGQIIbKE+rocZexQXDTI1MTEwNDA3NTEyOVowGQIIf0uUc6eaVsAXDTI2
 MDIwNjA4MTU1OVowGQIIY+eb3zFca1MXDTI2MDcxNzEzMTAyOFowGQIIE0bdhdft
 AUIXDTI1MTEyNjA3MzgxOFowGQIIT2xxXPFZRbYXDTI2MDEyMDEzMzU0NVowGQII
 UkplZOj2P2MXDTI2MDYxNjA5NDIwOVowGQIIYn42KDa3L/kXDTI2MDcxNjE0MDM1
 M1owGQIIInNDh7IsXhcXDTI2MDQxNjExMDMxN1owGQIICKAO9LVSvaAXDTI2MDkx
 NTA5NDc0OFowGQIIZO8YVuy97SQXDTI1MTAwMjExMTAyN1owGQIIJ+Z6wziRjJ4X
 DTI1MTAwMjExMTYwN1owGQIIIEFHTk7F1gsXDTI1MTEyMDA5NTcyN1owGQIIPko+
 m2Vy3McXDTI2MDYyOTA5MTI1NVowGQIIIDwyl8gVSMkXDTI1MTEyMTIwNDUxOVow
 GQIISdcQIZXutooXDTI2MDQxMzEzNDEzM1owGQIIbuT4JiU8OFAXDTI1MTIwMjE1
 MTQ1MFowGQIIY+4uKoNK84UXDTI1MTAxNjA3NTUyOVowGQIIZ0QawiA6/iYXDTI2
 MDkyOTA4NTgwOFowGQIIOHuIUJusOhcXDTI2MDMyMDE2MDI1OVowGQIIcqGOXGrM
 RdMXDTI2MDcwMzEyNDgxNFowGQIIPne+2s5z8S8XDTI2MDkyMjEzMzAyNVowGQII
 eZiJN0CAcDsXDTI2MDEwNzA5MjA0N1owGQIINN3rroiSTEQXDTI2MDcxNTExNTcz
 MlowGQIIfs/AxFNTT28XDTI2MDUxODA4MzEwOFowGQIIQzxcao59hcYXDTI1MTEw
 MTA5MTU1MVowGQIIEH9H99BhDQYXDTI2MDYyNTE1MzE1OFowGQIIb8+2DdusVG8X
 DTI1MTExMDEwMTAzNlowGQIIae9A8zz6b7sXDTI2MDQwMTA2Mjg1OVowGQIIINVu
 DnOezS0XDTI2MDcyMzA3MzAzMlowGQIIFeYu/X8nbsMXDTI2MDkxMTA2Mjk0NFow
 GQIIdESSq793u1gXDTI1MTEwMjEwNDEyOFowGQIIahLWmQxae+EXDTI2MDUyNzA2
 MjExNlowGQIIZxPdOyDDMRkXDTI1MTEwNDA5MDMxMVowGQIIXVnUTY2XtIUXDTI1
 MTEwNTE2MDczNVowGQIIQaWn/fkln5sXDTI2MDEyMDEzMzUwMFowGQIIMCCITuVM
 XfQXDTI2MDYyOTExNTcxN1owGQIIAzQNKMYpOBsXDTI1MTAwNzEyMTAyNVowGQII
 EfMNg6J5K3wXDTI2MDUxMTEyMDMyN1owGQIIIU/n2JF2+3MXDTI2MDUxODA2MDYx
 NVowGQIIFQNENN9WUfMXDTI2MDQwNzE0MDAyMlowGQIIY9pnje/3WZAXDTI1MTAx
 MDE1NTUyNlowGQIIcsA/9oSy8aMXDTI1MTEyNDA5MjI0MVowGQIIChL5tS0PkiwX
 DTI2MDUwNTA3NTAyMVowGQIIUIgq5xBKhWIXDTI2MDEwNTA4NDcwMlowGQIIJPwR
 OLdENO4XDTI2MDkwMzE0MDYyNVowGQIIdepPNvs6g98XDTI2MDkxNTA2NDkyOFow
 GQIIfieK/LJt8AEXDTI1MTAyMTA4MjEzMVowGQIIVzBSR0ukBpwXDTI2MTAwMjA4
 MjQ0MlowGQIIZ9YSiFi3cu4XDTI2MDcwODA5MTMyMlowGQIIHiaiVUPFDsEXDTI1
 MTIxMDA5NDMzNlowGQIII1oP5Y8l2dQXDTI2MDcyMDE5MTEwNVowGQIIWvB++OKF
 j10XDTI1MTExNjA5NTUzM1owGQIIL+WkH6xWigMXDTI1MTExMzA3Mzc1N1owGQII
 V5PIi1ZKXToXDTI2MDgzMDEyMjY0NFowGQIIJBPSP3mmzdoXDTI2MDEyODEyMDU1
 M1owGQIIBoDh/2IUwekXDTI1MTAwODEyMTg0OFowGQIIJm0LoJ/sROoXDTI1MTEw
 NjEwNTcyMVowGQIIYk5Rp+sjneYXDTI1MTAxNTEwMjAxNlowGQIIFbGHEEin5gsX
 DTI1MTAyMDEyNDMwNVowGQIINFxmpvf9uvcXDTI2MDgyODA3MTcxNFowGQIICHPV
 WIGIzSAXDTI2MDIxMjE5MTcwNVowGQIIKgqZH/08S7YXDTI2MDYwODEyMzcxNVow
 GQIIMdxioTVehjcXDTI2MDkyOTIwMDQ0MFowGQIIJhvqUPFve9oXDTI1MTIwODEw
 NDIyNFowGQIIOoORuebTtoIXDTI2MDExNTA2Mzc1NlowGQIIQVFDkFsxixsXDTI1
 MTAxNzEzMDMzOFowGQIIe6XyIg4kQvQXDTI1MTAwNjEyMDY1NVowGQIIR8l9MlTb
 l8QXDTI2MDIwMzEwMTkwOVowGQIIQ1dbYpVf80YXDTI1MTEyNDEwNTg0MFowGQII
 VQaTTVNaI0sXDTI2MDkwODEwMjY1M1owGQIIF0SXS58bT6MXDTI2MDQxMjA5MTg0
 MVowGQIICewuBOmmrTkXDTI2MDYyNTE1MjUyNlowGQIIPwH9hRRTHGkXDTI2MDIy
 MDA3Mjk0OFowGQIIYX8M+IhEwecXDTI2MDcxNzEzMDMzMFowGQIITnEpmqbAiVoX
 DTI1MTEyNDA5MzgwNlowGQIIaXKrPZxiyzIXDTI1MTIwMjExNDI0MFowGQIISMLv
 5/HdOaYXDTI2MDUxNDA5MjgxNlowGQIINUnpr0mtGf0XDTI2MDkyOTEyNDEwNVow
 GQIIM/9DyAgpaW8XDTI2MDUyNjEwMjE1NFowGQIICMhXhunT/L4XDTI2MDMyMDA3
 NDYxMVowGQIIAq0/Sx4VsaQXDTI1MTAxNzEzMDUzOFowGQIIKnAiiKgQxjIXDTI1
 MTEyNjE5MjU0OFowGQIII5dyjkClMl8XDTI2MDQzMDA5MjEwMVowGQIIF+nqKLg9
 46QXDTI1MTAwODEwNDM0OVowGQIISjEr35VqGuEXDTI2MDQwODEzMjUwN1owGQII
 fAhULLqErhcXDTI2MDUyMDA1MTYwNVowGQIIO5Jo7pem3Q4XDTI1MTAxNDEwMDAz
 OFowGQIICDq9lZHqOzEXDTI2MDYxNTA2MzUwNFowGQIIDCUOwLwkaUoXDTI1MTEy
 NzEwMjc0NlowGQIIfKxiawqtmb0XDTI2MDUxMjEwNTIwM1owGQIIMpvCr17+/+sX
 DTI2MDMwMjA3MjkzOVowGQIIAju3lBGAW5oXDTI2MDMwMzExMTgxM1owGQIIPIDp
 2Q+/X5UXDTI2MDkwOTA1MzAwMVowGQIIXaQU/3tt8lsXDTI2MDQwODEzMjQxOFow
 GQIIN9p2LMvinVsXDTI2MDIxNzEyMDgxNVowGQIIJqdWkZ/LQBwXDTI2MDkwNzE3
 NTY1MFowGQIIHsYIyInWvQ4XDTI2MDQwNzA2MjExNFowGQIIIjIBiqzq3EEXDTI2
 MDgyODA3MDkzOFowGQIIS5AoYpCEHlgXDTI2MDYyMjA2Mjg0NVowGQIIBFZEwHfA
 MfQXDTI1MTIyMjEzMDc0NVowGQIIH3WFAgIY0ccXDTI2MDYwMjA3MzIzMlowGQII
 CDrAXCb6Sk4XDTI1MTAwMjE5MjEyMFowGQIICz3QKkLfm94XDTI2MDkwMTE2MzQ0
 MVowGQIIXaZvBFfd2o8XDTI2MDYwNTA4NTI1M1owGQIIOBX2e14+XB8XDTI2MDMy
 NDA4MzEyMVowGQIICN+4q7Ids2wXDTI2MDEyNzA4MDUxN1owGQIIF2P1MyHmx1AX
 DTI1MTAxNDEwMTE1MFowGQIIMYFqigt7RGwXDTI2MDUwNTA3MzQzMFowGQIIOrdl
 8wsUC2QXDTI2MDYwNTA4NTMzOFowGQIILFeZfAqZ8tcXDTI1MTAwMzE5Mjg1NVow
 GQIIT/BwMpYlRrUXDTI1MTEyODExMTkxMlowGQIIDA3wK+KyvLIXDTI1MTAyMzA5
 MTM0MVowGQIIe+f8p1lmFbYXDTI2MDgwNDEwMTE0M1owGQIID0Dv1PcLdgYXDTI2
 MDEwNzEzNTEyNVowGQIIeJYpUVVfeucXDTI2MDIxNjExMzQxMFowGQIIf+bc2kQd
 2E4XDTI2MDYyOTA5Mzg0MFowGQIIJkJ2C4Jc8MwXDTI2MDYxMTExNDMyM1owGQII
 cVgdw0yfWVgXDTI2MDIxODEwMjYyNVowGQIIDSPges7W4fYXDTI2MDQwODEzMzMz
 MFowGQIIJfSYiD+gEQ0XDTI1MTAxNTE0MjMwNlowGQIIIFQYctIx5v0XDTI1MTAx
 MzE4MDU0MVowGQIILOysJ8mMgEkXDTI2MDgyMTEzNDc1OVowGQIIFNXghew2E4kX
 DTI2MDkxNTEzMzA0MlowGQIIMXEiFsZRp+gXDTI1MTEyMTExNDEzNlowGQIIJ/Oh
 mzp/1RAXDTI2MDUxMTExNTMzMVowGQIIHqkOq3IIUjwXDTI1MTAxOTE4MjQxNFow
 GQIICC57uK53vpUXDTI2MDQzMDA3MjEyOVowGQIIUriOiPI7brIXDTI2MDkwODEw
 MjY0M1owGQIIJj8YeRYbJ8sXDTI1MTIwMTE1MTYyMlowGQIIUTnE3mjq0JAXDTI2
 MDMxMTE0MjkzOVowGQIIaWtEWdqPoSUXDTI1MTAwNjEyMzkwN1owGQIIKRrO+Rdt
 z2wXDTI1MTEwNDA3NTQ1MVowGQIIaqVHEVweOioXDTI1MTIxOTE0MTUzN1owGQII
 KvhJaikszZAXDTI1MTAyOTA5Mjc1M1owGQIIWvHgJlsly3cXDTI2MDUyNzE2NDYy
 MVowGQIIeGn+quSTe/8XDTI2MDcwMTA3NDU1OFowGQIIfJzwjfsA564XDTI2MDcw
 OTA3NDAyMFowGQIIDiNdsncdIucXDTI2MDYyMjE2NTQxMVowGQIIO7Z51f5KA4EX
 DTI2MDIxODA3MDUyMlowGQIIJf7gfEzNKGAXDTI2MDUyMTA2NTczOVowGQIIHWIQ
 1PKmJX8XDTI1MTEwMjEwNTU0NVowGQIIec6YCIoC2boXDTI2MTAwNTE1MTQzOVow
 GQIIbUPAx+hYs4YXDTI2MDYxOTEzNTkyMlowGQIIcxCrjzdNOrEXDTI2MDcxMzEy
 MTA0OVowGQIIEaDZoqb9FwgXDTI2MDUwNjA1MzUwMlowGQIIHZvS79h/NjsXDTI1
 MTIwMjExMjU0MVowGQIIF509TpI3YtYXDTI1MTAxNTExNTAwNlowGQIIT0fITGJb
 2y4XDTI1MTIwMzIwMzEyMFowGQIIZdUz8joqRaUXDTI2MDUyNzE4NTU0MVowGQII
 YqAK5gXV4HoXDTI2MDcwNjE0MDcyNlowGQIIc0Y8ScuuFnkXDTI2MTAwNTA3MDIw
 NlowGQIId1PxAXNaNP4XDTI2MDczMTA2NTcyMFowGQIIWtOmzd6TtmcXDTI2MDky
 OTEzMTk1MFowGQIIJZvXfQk735YXDTI2MDkwMjA4MjcyMVowGQIIUIOvDtJU1EsX
 DTI1MTIxNTIwMDE1OVowGQIIEf94P9BJ9t0XDTI2MDUyOTE1MTczOVowGQIIKf4w
 R6Zi7zoXDTI2MDUxODA2MTM1M1owGQIIWXZCBL6+pdQXDTI2MDkxNjEwNDMwNFow
 GQIIGoqYNwadV1AXDTI2MDgwMzA3MTUxOFowGQIIXg/hSqYdW7MXDTI2MDcyNzE5
 NDIyM1owGQIIAw3RjkFZXGQXDTI2MDgzMTEyMjEyNVowGQIIAoEHWCIBGMQXDTI1
 MTExNjEwMzQxNVowGQIIHDecbnOolr4XDTI1MTAxMzE4MDYzMlowGQIIMenjZOib
 oNYXDTI1MTAyMDEwNDU1OFowGQIIIofwKKiA7PkXDTI2MDcyMzE0MjkyMlowGQII
 C5Zs+eVmybcXDTI1MTIwMzIwMzIwM1owGQIINDo7QIrWSasXDTI2MDEwNzE3Mjgz
 M1owGQIIZTuIj/XyoSMXDTI1MTAwMzE3MzExMFowGQIICp+OZ42EQlQXDTI2MDUy
 NTA4NTE0MVowGQIIEAgP/rBzX70XDTI2MDkwNzEyMzU1OFowGQIIO5FuhGQDXhIX
 DTI2MDcyNzIxNDExNVowGQIIaG/atHNa4XwXDTI2MDgyNDA5MjQwNVowGQIIAz2Y
 JX4o2/cXDTI1MTAxNzEzMDQyNlowGQIIQ7Lm/pDJi6oXDTI2MDQyMjAwMzMzOFow
 GQIITsttM/M7Wm0XDTI1MTEyMjAyMjg1MFowGQIIYaLHAWjfw6UXDTI1MTEyNzA4
 NTMzNVowGQIIJQQmG3y7XQkXDTI1MTEwNzEzMjIzOFowGQIIPfNRQmx8pQMXDTI1
 MTEwNjIxNDI0OFowGQIIDwU7bDEsDTwXDTI2MDYxNTEwMjIzNlowGQIIcHmCzh6K
 LBcXDTI2MDcxMDA4MDAyOFowGQIIAjbty4b3dC0XDTI1MTIxNzIyMzIzN1owGQII
 GIJhCvC8vyAXDTI2MDEyMDEzMzgxNlowGQIIDHBUM+MTvYoXDTI2MDIxNjExMzky
 OFowGQIIfWUVsXT6Hg0XDTI1MTEyNzA5MjczOFowGQIIRPDVeldIuaoXDTI1MTAy
 MzE2NTYxOFowGQIINz1uhwu5YJUXDTI1MTExMTA3NTEwM1owGQIIEJ3rriTZkb8X
 DTI2MDYxMTA2MzUzMVowGQIIBTznbZIbRlMXDTI2MDIxNjExMjYzOVowGQIIPagq
 2PjakYwXDTI2MDkxNTA2NTEwNFowGQIIa+FgHerm4OUXDTI1MTEwNTE2MDU1M1ow
 GQIISN+7oBf9vewXDTI2MDcyMzE1MzUzM1owGQIIXLX1jnsLE3UXDTI2MDMyNDE2
 MTc0OVowGQIIMr7rejBNLDIXDTI1MTExOTIxNDMzM1owGQIIDz3I6d3bGUMXDTI2
 MDQwNzA3MjIzN1owGQIIcTuYpxJBFB4XDTI2MDYxODEwMjEwM1owGQIIBMHU2Ko9
 BFkXDTI1MTIwMTEzMzQxMFowGQIICC27XX0Wt8kXDTI2MDIxNjExMzgyM1owGQII
 B4uz1azIUP8XDTI2MDYyMjExNTIwM1owGQIILJPWhJFnnoMXDTI2MDEyMDEzMTI1
 NVowGQIIfKXkjacqUUsXDTI2MDExMjIyMTQwNFowGQIIWPS4HpRvqbAXDTI1MTEy
 NjA3NTczOFowGQIIPC3/T3HH1wsXDTI1MTAyOTE0MjcwOVowGQIIMUiNWSoAQQUX
 DTI1MTEwNDE1MjEzNFowGQIIOYgtJBa781EXDTI1MTIxNTIwMTkwNVowGQIIOJ1q
 lfI0LHEXDTI2MDgwNzA4NTUxM1owGQIIXXq99FZW1LQXDTI2MDkwMjA4MzMyM1ow
 GQIIKWMCH/ST5o4XDTI1MTAxOTE5MzYzMlowGQIIJEAhg56jt3UXDTI2MDYyODEy
 MDM0OFowGQIIAXqYKxpnuQkXDTI2MDUyNjA3MDk1OVowGQIIVFgu3Mkb1u4XDTI2
 MDQwOTEzNDEwNFowGQIIXqV+TMawcKYXDTI2MDYyOTE1NDI0M1owGQIIVYQxxZkv
 1QYXDTI2MDkwNjE4NTY0N1owGQIIBd5VPxN4OBoXDTI2MDIyNDE0NTExNFowGQII
 RLeFdPjDIXsXDTI2MDkxODA2NTIwNFowGQIIBmTK5B6jGAoXDTI2MTAwNTE0MjEz
 MFowGQIIEOGGPdufvEYXDTI1MTEyMTA3MDkwMVowGQIIRXwBTXN2qCUXDTI1MTAy
 MDA2NDM0MlowGQIIZH4V1WQhVZ4XDTI2MDEyODEyMDcyN1owGQIISaIxfVkLyZwX
 DTI2MDYxMTEzNTg0M1owGQIIC+vrr179GvQXDTI2MDMwMjEzMTYyN1owGQIIHcoo
 YDhiwg8XDTI2MDcwODEyMzc1NFowGQIIXPgO1HmiSpkXDTI2MDQyNDEyMjY1Mlow
 GQIIY4R7/Ekn5icXDTI1MTEwNTEyMTUyNVowGQIIH5v/d93xrRsXDTI1MTAyMDEw
 MzAzNFowGQIIelGp2TRbOuEXDTI2MDkxODExMDkzOVowGQIIWKSvQc1n8QYXDTI2
 MDgwMzA3MDc1N1owGQIITbE23PsSk5sXDTI2MDExOTE0NDExMFowGQIIBiqRK3nP
 Fz4XDTI1MTEwNDE0MjY1NFowGQIIL7k5jXdSOZkXDTI2MDUxOTA5NDY1NVowGQII
 SwRIoQccT5gXDTI1MTAwMTEzMTk1NFowGQIIO+0td/KaNkMXDTI2MDQxNTExMDEw
 NlowGQIIdhWgkhkuiycXDTI2MDUyNTA5NTkzMlowGQIIKraDl0ZldrQXDTI1MTAw
 ODEyMjQ0OFowGQIIJxE9bkjeCksXDTI2MDYxNTEyMTM1OFowGQIIFva6DRqvZlcX
 DTI2MDYyMjEzNTUzOVowGQIIdG7nw0wvSPYXDTI1MTEyNzA4NTYyNlowGQIIN1mH
 3g49lsgXDTI2MDUyNjEzNDg0M1owGQIIWOLdx6gv2JIXDTI2MDEwNTA3MzU1MVow
 GQIIKXVDQs5LNZcXDTI2MDkxMDA4MTExOVowGQIIIgd6b+1OVBoXDTI2MDQyOTEz
 MTYyNlowGQIIYADlz2qkbywXDTI1MTEwNTE1MDg0NVowGQIIaW/7YSEuYiMXDTI2
 MDgyMDExNTQzNFqgMDAuMB8GA1UdIwQYMBaAFMEeu6Q/DhPfgZu+TGKy2bq+1ba7
 MAsGA1UdFAQEAgIkETANBgkqhkiG9w0BAQsFAAOCAQEAFFutgiPbpO00CErMmyji
 QzQHVOh3L312M3on35mJQ4wM8jGkQeOMwxFDtQk0OAg1VZlHClyzKdEF0Uw/JmfZ
 g8qJ1HC328Gbo/Y17Ypq2A6B2hmJjwIQg+w182FLMQzRWjQiNBtAQ4AGqe8GHf3r
 QTUJZL3KR1OIwXPZv37RbG6AP5NHs6rpz+Nf7qZTazAETeHme88KCy/hNBqyqB4E
 MjE3JfqG9p33XZGbmtpf5a6sNxQesrp+5R9h1YcNPVVuRwh8rqGlDMgkb7ftDfqf
 Th7ntjBsk8Km0kliQOgir8i6GC/BBkPlru+bGKbZEo26B4ddthjWclYj6oa27gin
 xA==
 -----END X509 CRL-----
 -----BEGIN X509 CRL-----
 MIICSTCCATECAQEwDQYJKoZIhvcNAQELBQAwXDESMBAGCgmSJomT8ixkARkWAmN6
 MRkwFwYKCZImiZPyLGQBGRYJY2VzbmV0LWNhMRIwEAYDVQQKEwlDRVNORVQgQ0Ex
 FzAVBgNVBAMTDkNFU05FVCBDQSBSb290Fw0yNjAzMTExMTAyMTNaFw0yNzAzMTIx
 MTAyMTNaoIGgMIGdMIGOBgNVHSMEgYYwgYOAFJ5BMOPD1U6Mg46jPMl/o20TXYQl
 oWCkXjBcMRIwEAYKCZImiZPyLGQBGRYCY3oxGTAXBgoJkiaJk/IsZAEZFgljZXNu
 ZXQtY2ExEjAQBgNVBAoTCUNFU05FVCBDQTEXMBUGA1UEAxMOQ0VTTkVUIENBIFJv
 b3SCCQCH9/oAc2kUTzAKBgNVHRQEAwIBGjANBgkqhkiG9w0BAQsFAAOCAQEAllsy
 RAg1qH/efzMXW4ZE1+1lB8GOVayA/ZoqJrXg6eTy0aruW64V/V7MDCAfdTPOlUHE
 s1NkgBgJYMeXWHd8tkTAiJv+50wbHwsJECr0a2KZ5WBmdOYzhWQHaM1AWGYPtGoj
 uU53UL0JOoHi/Gm4tlHfGSneWbmQmBDzrN/C/lZ+QTxY7ZJK02uLfbco60ktVoYA
 N7g8SghtlzwwICsM06N6QjWo0OK61HVWhDBWeyByEK9fk5ewGIEgV3wJhwZeLJT0
 7e2iOwIwo8+SNc77FS+aaFOU+Fgd89r1MCnuy9/sWKc9Rpmm4cSd11dLZhlRXGfR
 GXKb2wujaj8Ha0iRGQ==
 -----END X509 CRL-----
@@ -2,17 +2,17 @@
 MIIC8DCB2QIBATANBgkqhkiG9w0BAQ0FADCBlTERMA8GA1UEChMIRnJlZSBUU0Ex
 EDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEiMCAG
 CSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3Vlcnpi
-dXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFFw0yMDAzMjIyMDE4NDVa
+dXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFFw0yNjA5MTgxMDMwNTVa
-Fw0yMTAzMjIyMDE4NDVaoA8wDTALBgNVHRQEBAICEAAwDQYJKoZIhvcNAQENBQAD
+Fw0yNzA5MTgxMDMwNTVaoA8wDTALBgNVHRQEBAICEAAwDQYJKoZIhvcNAQENBQAD
-ggIBAHeOBgUbAkWJHJttPeW3ldH+im6LtMjCl+UnV55q9PbiWmAljmAWKP4KVy0p
+ggIBABHK9i209Jx6iSu0+YIgeZLo1X0I8CLw5pnWopQIwd40PBbjLqvY3KjFUj8b
-SFULBybfUCZG+5yfyfst2zr9nrw45NSGR/BhMHsS/DrLl5BRcnPy6BpNy+1oQdUN
+AAHzYqrmVDFvBA4VXJB+uzf7L8JeveipwHCnoGERwczEI4gNWyYENeUW9hATDrr6
-H+fPDeHt61wWb27wdbDbpVh7BkxijCLwIlRlbg6Lhom5wVXyGUucWEcppJVaNcic
+BsIrueXmgqDZjhAW0impc8vaPxLLtNWJIGnl2KR5aaYqKyWqdlR9zBzvp6qNAPJN
-lAJ+GgugQuCb1MWIlnMTGz9paOmcQ/cr/s3EqgqIaynaF1jgUpBDVX0NCOcYRuxk
+xTxLHA833ddFq8LVXdYk87ACQEymof/wxBF9aTA/qYyEptFIAWgeRcoWxigA+2IB
-T+kcyUzuE8i3dPzBNDxyBbCBRVdn5HZ0HJO9rH2MzMkRAwSuXK0A0VShPV4x1+Lg
+MjVfGGB2dop5Oo9xe6ZUu6wOJmJS+nMEDvyzMeoGLU9QtEZOo+W6cF4/+si1DH0B
-74Feov5kMmSxnFMoOGxMOw/QibANSot92snqO27C3xdO/GUV3kVXe4lHo1boCViA
+VwU2JgHOc7VKZwOWE9mlOrL9+b/1IHSghg7RsQ3+HE0Puo/PGDAKjJcOa6TOvhSo
-mTHz50li7oVbSEVnWn7THMWJ3KeYH28fQlvx48G8QPtnG0YHF6oIo/D+aCBKoFDB
+eRMnOTV/axmFsv3/tvrsymVJ/phoYoHZaXkaoGugNwDzVMTTVx6dSpbd/n8JFDCh
-FQegEwlVYvQHQTlbsX2uCwb5+zo8qLOtaoxBmPMKAXGr26Y81qg1O3ucMERKN4Ai
+KbOs0aNB1ZBnWMw5HwUxV+dGXjyZOib+M0W2SdMGrXycxG70M7Vg/ZWYjQboE6Sp
-9ULWQZWF2k+Lfmct+E0EoffAaZYgipxGiUWhSeuOeOdhx31qRNOQ+s8QsTfUxWJs
+o1hjUCONq3QdU3L5luy9vUatp6cgSj58w20CQRkaibW5S/8fjfYCsePG7hRHO5ht
-XXhSKDqCMbqudPFOX2uezWOM5HiG5MQhib9K8pmPPdQ28/P4KizI2ChgF27XpQOJ
+YX5UU8n61kkgq5n8w3VF9G3khCEmiK+0/5YXDmwQ71UM0OZkYaKBgaQt8+HC2X12
-PUlemsxYjgXWhja5IU4VOGHljMFX1sHIAb6+XAlE3qwTEWcw
+dUGrgUfytqHQtKTZsKbhpRSGC1oj1TGIyENG9lh7307RsARx
 -----END X509 CRL-----
@@ -1,41 +1,46 @@
 -----BEGIN X509 CRL-----
-MIIDuTCCAqECAQEwDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVVMxFTATBgNV
+MIIDVjCCAj4CAQEwDQYJKoZIhvcNAQELBQAwcjELMAkGA1UEBhMCVVMxFTATBgNV
 BAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTExMC8G
 A1UEAxMoRGlnaUNlcnQgU0hBMiBBc3N1cmVkIElEIFRpbWVzdGFtcGluZyBDQRcN
-MjEwMzE3MjAzMzIxWhcNMjEwMzI0MjAzMzIxWjCCAccwIQIQC9r9CykUM5qWEmas
+MjYxMDA1MjMwODAzWhcNMjYxMDEyMjMwODAzWjCB9TAhAhAL2v0LKRQzmpYSZqw1
-NTpHRBcNMTYxMDI0MTc0MjQ5WjAhAhAB+NKDLSkZGXGzUMPbvKUAFw0xNjExMTEx
+OkdEFw0xNjEwMjQxNzQyNDlaMCECEAH40oMtKRkZcbNQw9u8pQAXDTE2MTExMTE1
-NTIxMzRaMCECEApSsGxG9esloIvVP9x7eIYXDTE4MDkwMzEyMTE0MlowIQIQDXcX
+MjEzNFowIQIQClKwbEb16yWgi9U/3Ht4hhcNMTgwOTAzMTIxMTQyWjAhAhAFlx7K
-eXMvGcnSq56UflPayRcNMTkwNTEyMTAzMTMzWjAhAhAMxgIr56pDbDTITESzk3/L
+SlmJinvPTLfjd5doFw0xOTA5MzAwODE2MjRaMCECEAxFkEkmQLBOlEh/jEwCeJAX
-Fw0xOTA5MjgxODAzNTJaMCECEArvSHyTAbnRz50UjFffg7AXDTE5MDkyODE4MTE1
+DTIxMDIwOTIyMzk0MlowIQIQBMvnUVSd49EL7YN0yV7iRBcNMjEwMjA5MjMyMzM3
-NlowIQIQB+Vhknlt9fe4f+PFrqat9RcNMTkwOTI5MDcxNTEwWjAhAhAFlx7KSlmJ
+WjAhAhALmUrhw5aLANVesgZ0jpseFw0yMTAyMDkyMzI0MjNaoIGfMIGcMB8GA1Ud
-invPTLfjd5doFw0xOTA5MzAwODE2MjRaMCECEAsbx6LoTjfZ86od8xhAl40XDTE5
+IwQYMBaAFPS24SAd/imu0uRhpbKiJbLIFzVuMAsGA1UdFAQEAgIPRzBsBgNVHRwB
-MTAwNDA5MDMxM1owIQIQCkJscPi965iIOgI2+1ocBBcNMjAwMjIxMDMxMDE4WjAh
+Af8EYjBgoF6gXIYsaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL3NoYTItYXNzdXJl
-AhAMRZBJJkCwTpRIf4xMAniQFw0yMTAyMDkyMjM5NDJaMCECEATL51FUnePRC+2D
+ZC10cy5jcmyGLGh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9zaGEyLWFzc3VyZWQt
-dMle4kQXDTIxMDIwOTIzMjMzN1owIQIQC5lK4cOWiwDVXrIGdI6bHhcNMjEwMjA5
+dHMuY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQAPMzUHmlpxtYo3Ex7UeNg1nZSH0mqr
-MjMyNDIzWqAwMC4wHwYDVR0jBBgwFoAU9LbhIB3+Ka7S5GGlsqIlssgXNW4wCwYD
+paYAEs3hF6e4Mc6PsUdtQtC+zCiW3h5VUokUPU2Bidkjc53DdcV9U16I8XowwJnw
-VR0UBAQCAgdjMA0GCSqGSIb3DQEBCwUAA4IBAQAP6Xpm/8VXcbmveUvvIGcTRDIH
+kYsq5/EjIts6ANHAJPs0G23yqqCpTIZhg5e6i6JQIA8tdi9hffiXf3MLiQD0h0PK
-cr+GO94ZLbcfLAWqD2T6b6Jr8uvPzo59+zGhjhhLETscrA/EEyZANSdxv9LxjYg1
+zgcPH1mQMwuAcLW9PpXAqcqOLcSFDOHK19BFUnMR4gHQOQ6rDGIhY+StViHHWU+M
-DKBj4urWLjkesHuXCm8a4OP0nhW2xULFDnSExhAr1t62lX+ycuV7fi+oY8U4hYdG
+AEWXFqGPVj2l4dkZrAH49TXYJj9NcRQRp5dlACN+30FhpKVQAr8N5aVcpmP/omJF
-MMO/+cYHs8hrchYzRcvn2jBewcnehhCX/GJ5OC2JXu9z1Om0efSfXb9oWlBkD1eh
+aEpq+hjRJgCRsdAguqbwoD3Ch9FVf8BV0re3YLj6a8AFMXS1gYmX/nUv
 hodUk96PgpkesATc7uoPC+XsyNrdz+wat+A97Y9aVs6WTTcONCPDlu7PP0or6sAw
 Iuu3ziSzpeuS73bayTIMRSduvuhN4IRI86bXH/WJ13Dn+kKWoJEv96DEe3iY
 -----END X509 CRL-----
 -----BEGIN X509 CRL-----
-MIIDCzCCAfMCAQEwDQYJKoZIhvcNAQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNV
+MIIEYjCCA0oCAQEwDQYJKoZIhvcNAQELBQAwZTELMAkGA1UEBhMCVVMxFTATBgNV
 BAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIG
-A1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBFw0yMTAzMTIwMTI5NDZa
+A1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBFw0yNjEwMDEyMzQ3MjBa
-Fw0yMTA0MDIwMTI5NDZaMIIBJjAvAhAMNtfIbq1n4/f4HXVg8i1TFw0xODEwMDkx
+Fw0yNjEwMjIyMzQ3MjBaMIICfTAvAhAHOSbHsl+5YpAf8d9FUCGIFw0yNDA4MTMx
-NTAwMTdaMAwwCgYDVR0VBAMKAQUwLwIQBoL7H4F3dqV5kSw+2RDv8RcNMjAwODEy
+OTE4NTZaMAwwCgYDVR0VBAMKAQQwLwIQBxVWH+V/ML4XiYkjwzpEUBcNMjYwOTE4
-MTIzMzA5WjAMMAoGA1UdFQQDCgEFMC8CEApBOhYATfpyJADTJoDkJIkXDTE4MTAy
+MDAyMzI1WjAMMAoGA1UdFQQDCgEEMC8CEAw218hurWfj9/gddWDyLVMXDTE4MTAw
-NTE2MTAzMlowDDAKBgNVHRUEAwoBBTAvAhACPHv+1hmOkW3l0EHImj0lFw0xODEw
+OTE1MDAxN1owDDAKBgNVHRUEAwoBBTAvAhAGgvsfgXd2pXmRLD7ZEO/xFw0yMDA4
-MjUxNjA5MzNaMAwwCgYDVR0VBAMKAQUwLwIQBkoduoMprQURTuDY6pi+fBcNMjAw
+MTIxMjMzMDlaMAwwCgYDVR0VBAMKAQUwLwIQC3hRTN/GgFLrRHzkC8KklhcNMjIx
-NzIxMjAwMDAwWjAMMAoGA1UdFQQDCgEFMC8CEAER6Rdjkvpnl9JRx+xhVCoXDTIw
+MDEzMDk1ODA3WjAMMAoGA1UdFQQDCgEFMC8CEAsqhekMa2Uu2MCOV/mEbMQXDTIy
-MTIyODE1MzY0MlowDDAKBgNVHRUEAwoBBaAwMC4wHwYDVR0jBBgwFoAUReuir/SS
+MTAxMzEwMDAzNFowDDAKBgNVHRUEAwoBBTAvAhAC8dXyHqirKBCgl3AVPcLQFw0y
-y4IxLVGLp6chnfNtyA8wCwYDVR0UBAQCAgI1MA0GCSqGSIb3DQEBCwUAA4IBAQAN
+MjEwMTMxMDAzMTFaMAwwCgYDVR0VBAMKAQUwLwIQCkE6FgBN+nIkANMmgOQkiRcN
-yaEdhOnCRSHwu/3HZcM0wB1VfOI4sv6vPS0KQ3AJYn3sO08c+l1qwK5aH2eV65aH
+MTgxMDI1MTYxMDMyWjAMMAoGA1UdFQQDCgEFMC8CEAI8e/7WGY6RbeXQQciaPSUX
-U6bHGTthnbF/tTtMbi291vK98QdPgh+WFEKTo/HBGlrhxnE1Noh8flLoimx1K6Io
+DTE4MTAyNTE2MDkzM1owDDAKBgNVHRUEAwoBBTAvAhAOn6HUxFmz0BodonYrg1Cc
-CuxayaUh7LC0RcgYwmVi7MnKQKpE2SHYqPTDkMokz+nQh1sibtTBHrS6fduKCItH
+Fw0yMjEwMTMxMDA1MTlaMAwwCgYDVR0VBAMKAQUwLwIQBkoduoMprQURTuDY6pi+
-FZ8MbiabMuBH+vLNt76SDoRvxfKgawSKeYBEf+oYQrK/d3bI7njYfda/cKjHYJez
+fBcNMjAwNzIxMjAwMDAwWjAMMAoGA1UdFQQDCgEFMC8CEAER6Rdjkvpnl9JRx+xh
-yXDurvnFOBBKrmpxUaf9LcbGKCjTCg5Fn9Bk02+mdJ4pOH8D1PNqaTmO5/B3AsuI
+VCoXDTIwMTIyODE1MzY0MlowDDAKBgNVHRUEAwoBBTAvAhAMVaXo089Ps1nwCyty
-dw+Syb5bUgz8QGTqL+7W
+L+75Fw0yMjEwMTMxMDEzMDJaMAwwCgYDVR0VBAMKAQWgMDAuMB8GA1UdIwQYMBaA
 FEXroq/0ksuCMS1Ri6enIZ3zbcgPMAsGA1UdFAQEAgIDXDANBgkqhkiG9w0BAQsF
 AAOCAQEAbp95b7N5u7stn7jSth9LbqIP0i2OeBZETdcWnfcG+ck99Mjm0eYMMjmt
 SaWIcTGTfK9rQ6xwgMG3yVKEOPjPq2XQ5mQlXj4isuCzp3KmVCUxs9du12QlSHJ5
 ObqWzprVjhZuYUyozh07ohuU4YLZHmRByZeih+TlRqzt5A+bQqCDZ+aLCvat/Clg
 zlSAAF1dCRniukekB5JtSc6h6YfdPXZC0vCqMi/CyxQEo83hfN1dVOEBos96zek4
 5wu0cTk8Cq1isfCBFOMxulcXLzYH7HZ3fC24hLrM8ijpNZjLjuUBC5euozDU4M0T
 sDO7suNrXqSB8DKcPYfUy0caMml+oQ==
 -----END X509 CRL-----
@@ -13,19 +13,19 @@ By using this post-commit hook in a repository and thereby adding secure timesta
 These hooks were written for git 2.30 and newer (they may or may not work with older versions of git). If you do not use Git Bash, you need bash-4.3 or newer.
-0. (optional, but recommended) If you're ceating a new repository, it is strongly recommended to use SHA256 hashes (git uses SHA1 by default at the time of writing) by initializing the repository using `git init --object-format=sha256` (Note: If you want to use a public hosting server such as github for your repository, you should check whether they already support SHA256 repositories). For more information, see https://git-scm.com/docs/hash-function-transition/
+0. (optional, but recommended) If you're creating a new repository, it is strongly recommended to use SHA256 hashes (git uses SHA1 by default at the time of writing) by initializing the repository using `git init --object-format=sha256` (Note: If you want to use a public hosting server such as GitHub for your repository, you should check whether they already support SHA256 repositories). For more information, see https://git-scm.com/docs/hash-function-transition/
 1. Copy the four bash scripts in the [hooks](hooks/) folder of this project into the .git/hooks folder of the project you want to timestamp.
 2. Configure the TSA url you want to use (in this example https://freetsa.org/tsr) using  
 `git config --local timestamping.tsa0.url https://freetsa.org/tsr`
-3. You must declare that you trust this TSA by copying the root certificate of that TSA's trust chain into the .git/hooks/trustanchors folder (create it if it doesn't exist yet). The certificate MUST be in PEM format and the filename MUST be "subject_hash.0" where`subject_hash` is what openssl returns for the `--subject_hash` argument for x509 cetificates (https://www.openssl.org/docs/man1.1.1/man1/x509.html).  
+3. You must declare that you trust this TSA by copying the root certificate of that TSA's trust chain into the .git/hooks/trustanchors folder (create it if it doesn't exist yet). The certificate MUST be in PEM format and the filename MUST be "subject_hash.0" where`subject_hash` is what openssl returns for the `--subject_hash` argument for x509 certificates (https://www.openssl.org/docs/man1.1.1/man1/x509.html).  
 **For your convenience, there is the [hooks/trust.sh](hooks/trust.sh) script which will do this for you.** To use it, simply run `.git/hooks/trust.sh https://freetsa.org/tsr` from your Git-Bash and confirm adding the certificate (Note: The certificates stored in .git/hooks/trustanchors are ONLY used to validate timestamp tokens, no other trust is established).
-4. (optional) If you want to use multiple TSAs, just set additional urls for tsa1, tsa2 and so on. Make sure that they are all defined consecutively, for example, if you have a url defined for tsa0 and for tsa2, but not for tsa1, then tsa2 will be ignored. Since timestamp tokens will become forever invalid should a TSA's private key leak, using at least two trusted TSAs is a good strategy to protect against this unlikely eventuality (see chapter 4. "Security Considerations" of RFC3161 specification).
+4. (optional) If you want to use multiple TSAs, just set additional URLs for tsa1, tsa2 and so on. Make sure that they are all defined consecutively, for example, if you have a url defined for tsa0 and for tsa2, but not for tsa1, then tsa2 will be ignored. Since timestamp tokens will become forever invalid should a TSA's private key leak, using at least two trusted TSAs is a good strategy to protect against this unlikely eventuality (see chapter 4. "Security Considerations" of RFC3161 specification).
 5. (optional) By default, a commit will fail if a timestamp token cannot be retrieved. If you want to make timestamping optional for a certain tsa, you can set  
 `git config --local --type=bool timestamping.tsa0.optional true`.  
 If `optional` is set to true and a timestamping token cannot be retrieved, you will receive a warning but the commit will be created nevertheless.
 7. (optional) You might want to add this README.md and the [docs](docs/) folder of this repository to your repository as well, so that documentation of the timestamps is guaranteed to be available if the timestamps should be evaluated many years in the future.
-From now on, every `git commit` will automatically tigger an additional commit that securely timestamps it.
+From now on, every `git commit` will automatically trigger an additional commit that securely timestamps it.
 # Implementation design
@@ -39,7 +39,7 @@ By embedding the timestamps in the commit history, they form a hash-chain and th
 # Merkle-Tree layout
-The design leverages git's Merkle-Tree layout and embeds the timestmaps in the commit history, making them form a hash-chain that prevents later changes without being noticed:
+The design leverages git's Merkle-Tree layout and embeds the timestamps in the commit history, making them form a hash-chain that prevents later changes without being noticed:
 ![Merkle-Tree](./docs/schematic.png)
@@ -59,7 +59,7 @@ Before writing this software, I evaluated alternatives available at the time of
 This script allows to manually create timestamps for revisions and store them in git-notes. This was not sufficient for me since having timestamps stored in git-notes makes them "cryptographically dangling" in the sense that the timestamped repository does not depend on them (meaning that they can be "lost" without being noticed). This may be the preferred solution for someone who just wants to be *able* to prove the time the code was created if he so desires, without creating a repository which is *tamperproof* (and without the benefits discussed further down). Also, the script does not take CRLs into consideration for validation.
 - GitLock (https://www.npmjs.com/package/gitlock):  
-GitLock adds timestamps as tags, which, like git-notes, also won't make the timestamped repository cryptographically depend on the timestamps themselves and thus offers the same advantages/disadvantages as the script above. It also creates a parallel SHA256 hierarchy (which isn't necessary anymore, since git now provides native SHA256 support) and depends on a Node.js application that must be installed and used manually. This solution may be preferred if the same conditions hold as with the first altenative and additionally SHA256 is required but a public git server which does not yet support native SHA256 commit hashes is used.
+GitLock adds timestamps as tags, which, like git-notes, also won't make the timestamped repository cryptographically depend on the timestamps themselves and thus offers the same advantages/disadvantages as the script above. It also creates a parallel SHA256 hierarchy (which isn't necessary anymore, since git now provides native SHA256 support) and depends on a Node.js application that must be installed and used manually. This solution may be preferred if the same conditions hold as with the first alternative and additionally SHA256 is required but a public git server which does not yet support native SHA256 commit hashes is used.
 - There is [this](https://gitlab.cs.fau.de/CSG/git-rfc3161) fork of git:  
 The fork was created as part of a university project to add native support for RFC3161 tokens to git. There is a corresponding discussion in the archived git mailing list (http://git.661346.n2.nabble.com/Adding-RFC-3161-timestamps-to-git-tags-td7650116.html). Since it requires a custom build of git and wasn't adopted by the official repo, I did not further investigate this implementation.
@@ -72,14 +72,14 @@ Zeitgitter seems to use a custom timestamping protocol and rely on developers cr
 # How are timestamps added to commits
-For each commit that is being timestamped, an additional *timestamp commit* is created, for which the commit that is being timestamped is the direct parent. The digest hash that is contained in the timestamp token is a hash derived from the commit hash of that parent commit as well as the tree hash of this *timestamp commit*. Since git itself is implemented as a [Merkle Tree](https://en.wikipedia.org/wiki/Merkle_tree), this hash hence depends on every bit of every commited file as well as the entire commit history, making it impossible to change anything without invalidating the timestamp. The timestamping token (one for each TSA for which a timestamp was retrieved from) is then added in PEM encoding (plus some info about the token in readable form) as a trailer to the commit message of the *timestamp commit*. Chosing this design to add the timestamps has several advantages:
+For each commit that is being timestamped, an additional *timestamp commit* is created, for which the commit that is being timestamped is the direct parent. The digest hash that is contained in the timestamp token is a hash derived from the commit hash of that parent commit as well as the tree hash of this *timestamp commit*. Since git itself is implemented as a [Merkle Tree](https://en.wikipedia.org/wiki/Merkle_tree), this hash hence depends on every bit of every commited file as well as the entire commit history, making it impossible to change anything without invalidating the timestamp. The timestamping token (one for each TSA for which a timestamp was retrieved from) is then added in PEM encoding (plus some info about the token in readable form) as a trailer to the commit message of the *timestamp commit*. Choosing this design to add the timestamps has several advantages:
 - The commit hash always depends on the entire data of that commit (including the pgp signature that commit is signed with) and its history, meaning that not a single bit of data being committed (or the history it depends on) could be changed without creating a completely different commit hash.
 - It is most likely the most forward-compatible option. If new commit headers or other commit data will be added to git in the future, they will most likely also be captured by the commit hash.
 - By storing the tokens inside the commit message, which is hashed itself, rather than in git-notes or tags, subsequent commits will *seal* these timestamps, making it impossible to "lose" them, which gives the timestamping of the repository a *non-repudiation* property (https://en.wikipedia.org/wiki/Non-repudiation), meaning it will be impossible to "rewrite history" unnoticed.
 - Since newer timestamps *seal* older timestamps (i.e. the older timestamps are part of what is being timestamped), this protects old timestamps from becoming invalid in some situations and can extend their validatability arbitrarily into the future (see Long Term Validation below). For example: Say in 2021 all commits are timestamped using a TSA that uses "certificateA" to sign its timestamps. Then in 2022 a TSA is used which uses "certificateB" to sign its timestamps. Then in 2023 the private key of "certificateA" leaks. Normally, if a TSA's private key leaks, all old timestamps become invalid and can't be trusted anymore (because the private key could be used to "backdate" data) - however, since in this case the timestamps of 2021, which are signed with the still trusted "certificateB" *sealed* the older timestamps, these old timestamps can still be considered valid, since they were provably created before the "certificateA" private key leaked. The same applies to old timestamps becoming invalid for example due to the algorithm used for them not being deemed secure anymore or if a CA stops issuing CRL data for the TSA certificate.
-An altenative design that was considered but dismissed was to include the timestamps right into the commit message of the commit that is being timestamped (in order to keep the commit history more tidy), in a similar fashion as PGP signatures are added. PGP signatures do this by calculating the commit hash AS-IF the signature was not contained, then sign this hash and then add the signature into the commit header (thereby changing the hash). A similar approach could have been taken with the timestamps, but this would have two serious drawbacks:
+An alternative design that was considered but dismissed was to include the timestamps right into the commit message of the commit that is being timestamped (in order to keep the commit history more tidy), in a similar fashion as PGP signatures are added. PGP signatures do this by calculating the commit hash AS-IF the signature was not contained, then sign this hash and then add the signature into the commit header (thereby changing the hash). A similar approach could have been taken with the timestamps, but this would have two serious drawbacks:
-1. Since PGP signatues are inserted natively AFTER the commit is generated, the timestamp token could therefore not timestamp the signature (instead, the signature would sign the timestamp, which is not useful).
+1. Since PGP signatures are inserted natively AFTER the commit is generated, the timestamp token could therefore not timestamp the signature (instead, the signature would sign the timestamp, which is not useful).
 2. Validation code would need to compute a commit hash AS-IF the timestamp-token was not contained, but also AS-IF any insertions happening AFTER timestamping were not present (at the time of writing, that's only PGP-Signatures. However, since future versions of git may include other additional headers in a similar fashion, this would break current timestamp validation code).
 For these reasons, adding timestamps right into the commit that is being timestamped was dismissed, for separate *timestamp commits* are much more likely to be forward compatible with anything git will add to the commit object in the future.
@@ -93,7 +93,7 @@ If a token does not pass these tests, it is not added and the commit is either a
 This repository uses the post-commit hook itself, so if you check the commit history of this repository, you will see that each commit is followed by a -----TIMESTAMP COMMIT----- that contains one or more timestamp tokens.  
 For example, [this](https://github.com/MrMabulous/GitTrustedTimestamps/commit/58ba3dbd480e3c07dbd14beca02092982f8e9492) *timestamp commit* timestamps [this](https://github.com/MrMabulous/GitTrustedTimestamps/commit/80034aeb7857a910f06429c3580635b4afa40cc0) regular commit, which is its direct parent. You can see that the "Digest" that is timestamped by the token is `d8f311290fb12fbd87c50014b75809150d125272=sha1(version:1,parent:80034aeb7857a910f06429c3580635b4afa40cc0,tree:50c7905ec6a07547e5bdeab38a810c2dc1c5ae44)`, whereas the tree hash and parent hash in the preimage correspond to the parent and tree of this *timestamp commit*.
-Since github did not support sha256 hashes yet at the time this repository was created, the hashing algorithm used is sha1 (for a repository initialized with `git init --object-format=sha256` the hashing algorithm will be sha256 or other, once git adds support for further algorithms)
+Since GitHub did not support sha256 hashes yet at the time this repository was created, the hashing algorithm used is sha1 (for a repository initialized with `git init --object-format=sha256` the hashing algorithm will be sha256 or other, once git adds support for further algorithms)
 # For how long are timestamps valid?
@@ -101,7 +101,7 @@ Generally, a RFC3161 timestamp can be trusted for as long as
 - the private key of the signing certificate or a certificate in its trustchain did not get compromised and
 - the hashing algorithm used by the timestamp and the signature algorithm used by the signing certificate is still considered secure
-To be sure of the first point, one must know the current revocation status of the signing certificate. This in turn means that once new CRLs for the certificate that signed the timestamp are not issued anymore, the timestamp shouldn not be trusted anymore, since timestamps could be forged if the private key of the signing certificate leaked.  
+To be sure of the first point, one must know the current revocation status of the signing certificate. This in turn means that once new CRLs for the certificate that signed the timestamp are not issued anymore, the timestamp should not be trusted anymore, since timestamps could be forged if the private key of the signing certificate leaked.  
 However, if one has a copy of a historic CRL that shows the signature certificate to be valid, and which is timestamped by a timestamp that still can be trusted, then also the compromised timestamp can still be trusted.  
 GitTrustedTimestamp enables this extension of the lifetime of timestamps by storing *Long Term Validation* data for previous timestamps with each new timestamp added.
@@ -128,7 +128,7 @@ This repository does come however with an [implementation](hooks/validate.sh) th
 To perform these checks, the same trusted rootCAs from the `.git/hooks/trustanchors` folder are used.
 No other checks are performed. In particular, a timestamp-token is considered valid beyond the expiration date of its signing certificate if it hasn't been revoked due to a reason other than those specified in chapter 4.1 of the RFC3161 specification.  
-The curent implementation of the validate.sh script also does not consider whether the hashing algorithms used in the timestamp-token or the keylength of the signing certificate are still considered secure, as this depends on what the validating party considers secure.
+The current implementation of the validate.sh script also does not consider whether the hashing algorithms used in the timestamp-token or the key length of the signing certificate are still considered secure, as this depends on what the validating party considers secure.
 The script exits with exit code 0 if all tests passed, and with exit code 1 otherwise.
@@ -147,8 +147,8 @@ retrieve_crl_for_most_recent_parent_timestamps() {
 }
 #get hash of unstamped commit
-PEARENT_COMMIT_HASH=$(git rev-parse --verify HEAD)
+PARENT_COMMIT_HASH=$(git rev-parse --verify HEAD)
-if ! retrieve_crl_for_most_recent_parent_timestamps "$PEARENT_COMMIT_HASH"; then
+if ! retrieve_crl_for_most_recent_parent_timestamps "$PARENT_COMMIT_HASH"; then
  echo_error "ERROR: Failed to download CRLs for last timestamp commit."
  exit 1
 fi
@@ -172,9 +172,9 @@ for ((i=0;; i++)); do
  TREE_HASH=$(git write-tree)
  declare PREIMAGE
-  get_preimage_from_tree_and_parent "$TREE_HASH" "$PEARENT_COMMIT_HASH" PREIMAGE
+  get_preimage_from_tree_and_parent "$TREE_HASH" "$PARENT_COMMIT_HASH" PREIMAGE
  declare NEW_DIGEST_TO_TIMESTAMP
-  compute_digest_from_tree_and_parent "$TREE_HASH" "$PEARENT_COMMIT_HASH" NEW_DIGEST_TO_TIMESTAMP
+  compute_digest_from_tree_and_parent "$TREE_HASH" "$PARENT_COMMIT_HASH" NEW_DIGEST_TO_TIMESTAMP
  if [ "$NEW_DIGEST_TO_TIMESTAMP" == "$DIGEST_TO_TIMESTAMP" ];then
    #no new LTV data added, no need to re-request token.
    break
@@ -271,10 +271,10 @@ get_tsa_cert_id() {
 # function to extract hashing algorithm used in the ESSCertID (always sha1) or ESSCertIDv2
 # param1: path to token in DER encoding
 # param2: OUT variable, the hashing algorithm string
-get_cert_id_hash_agorithm() {
+get_cert_id_hash_algorithm() {
  local TOKEN_FILE="$1"
  local -n ALGO_NAME_OUT="$2"
-  log "get_cert_id_hash_agorithm for $TOKEN_FILE"
+  log "get_cert_id_hash_algorithm for $TOKEN_FILE"
  #perform precondition checks
  assert "[ ! -z $TOKEN_FILE ]" "Precondition: Path to token file must not be empty."
@@ -401,7 +401,7 @@ request_token() {
 # param2: the digest the token was requested for
 # param3: the tsa url from which the token was requested
 # param4: the output file for the chain. It contains all certificates in order, with the first
-#         one being the TSA cetificate and the last one the self-signed root certificate.
+#         one being the TSA certificate and the last one the self-signed root certificate.
 build_certificate_chain_for_token() {
  local TOKEN_FILE="$1"
  local DIGEST="$2"
@@ -417,18 +417,18 @@ build_certificate_chain_for_token() {
  local DUMMY_TOKEN="$TMP_DIR"/dummy_token.tst
  local ALL_EXTRACTED_CERTS="$TMP_DIR"/extracted_certs.pem
  local CHAIN=()
-  #if the TSA uses multiple certificates to sign tokens it may take a few attempts to get one containint the proper signer
+  #if the TSA uses multiple certificates to sign tokens it may take a few attempts to get one containing the proper signer
  #TODO: allow to set maximum retry attempts
  local SIGNING_CERT_ID=""
  get_tsa_cert_id "$TOKEN_FILE" SIGNING_CERT_ID
  local CERT_ID_HASH_ALGO=""
-  get_cert_id_hash_agorithm "$TOKEN_FILE" CERT_ID_HASH_ALGO
+  get_cert_id_hash_algorithm "$TOKEN_FILE" CERT_ID_HASH_ALGO
  local -i i
  for i in {1..10} ;do
    #request dummy token. Use current commit digest
    request_token "$TSA_URL" "$DIGEST" true "$DUMMY_TOKEN"
-    #extract certifcates
+    #extract certificates
    openssl pkcs7 -inform DER -in "$DUMMY_TOKEN" -print_certs -outform PEM -out "$ALL_EXTRACTED_CERTS" &> "$OUT_STREAM"
    #remove files from previous runs
@@ -440,7 +440,7 @@ build_certificate_chain_for_token() {
    | awk '/-----BEGIN CERTIFICATE-----/ { i++; } /-----BEGIN CERTIFICATE-----/, /-----END CERTIFICATE-----/ \
    { print > tmpdir i ".extracted.pem.cer" }' tmpdir="$TMP_DIR/"
-    #find cetificate that signed token
+    #find certificate that signed token
    local EXTRACTED_CERT
    while read EXTRACTED_CERT; do
      local CERT_ID=$(openssl x509 -inform PEM -in "$EXTRACTED_CERT" -outform DER | openssl dgst -"$CERT_ID_HASH_ALGO" -binary | xxd -p -c 256)
@@ -535,7 +535,7 @@ download_crls_for_chain() {
  assert "[ -f $CERT_FILE ]" "Precondition: Certificate file $CERT_FILE must exist."
  echo -n > "$OUTPUT_FILE"
-  local CRL_TMP="$TMP_DIR"/crl_tmp.crl
+
  #remove files from possible previous runs
  rm -f "$TMP_DIR"/*.extracted.pem.cer
  #extract all contained certificates into separate files
@@ -553,7 +553,13 @@ download_crls_for_chain() {
      local URL=$(openssl x509 -inform PEM -in $EXTRACTED_CERT -text -noout \
                  | awk '/CRL Distribution Points:/{f=1} f && /URI:/ {print; exit}' \
                  | sed 's/^.*URI://1')
-      if curl "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"; then
+      local CRL_TMP="$TMP_DIR"/crl_tmp.$(echo "$URL" | sha256sum -z | awk '{printf "%s",$1}').crl
      local CURL_EXIT_CODE=0
      if [ ! -f $CRL_TMP ]; then
        curl -L "$URL" --output "$CRL_TMP" &> "$OUT_STREAM"
        CURL_EXIT_CODE=$?
      fi
      if [ $CURL_EXIT_CODE -eq 0 ]; then
        if openssl crl -in "$CRL_TMP" -inform DER -noout &> "$OUT_STREAM"; then
          openssl crl -in "$CRL_TMP" -inform DER >> "$OUTPUT_FILE"
        elif openssl crl -in "$CRL_TMP" -inform PEM -noout &> "$OUT_STREAM"; then
@@ -95,7 +95,7 @@ if [[ "$RESPONSE" =~ ^([yY][eE][sS]|[yY])$ ]]; then
  echo '' >> "$TARGET_FILE"
  cat "$ROOT_CERT" >> "$TARGET_FILE"
  echo '' >> "$TARGET_FILE"
-  echo_warning "Added cetificate as $TARGET_FILE"
+  echo_warning "Added certificate as $TARGET_FILE"
 else
    echo_warning "Aborted."
 fi
@@ -42,8 +42,13 @@ if [[ ! -d "$DIR" ]]; then DIR="$PWD"; fi
 . "$DIR/timestamping"
 declare -i MINVERSION=$TIMESTAMPING_VERSION
 declare -i MAX_COMMITS_TO_CHECK=0
 declare -A PROCESSED_COMMIT
 declare -A PROCESSED_PARENT
 declare -A COMMITS
 declare -A COMMIT_TIMES
-while [[ $# -gt 1 ]]; do
+while [[ $# -gt 0 ]]; do
  KEY="$1"
  case $KEY in
@@ -61,17 +66,27 @@ while [[ $# -gt 1 ]]; do
      shift # past argument
      shift # past value
      ;;
    -max|--maxcommits)
      INTEGER_REGEX='^[0-9]+$'
      if ! [[ "$2" =~ $INTEGER_REGEX ]]; then
        echo_error "$KEY: expected positive integer"
        exit 1
      fi
      MAX_COMMITS_TO_CHECK="$2"
      shift # past argument
      shift # past value
      ;;
    -v|--verbose)
      OUT_STREAM=/dev/stdout
      shift # past argument
      ;;
    *) # unknown option
-      echo_error "Unknown argument: $KEY"
+      OBJECT=$KEY
-      exit 1
+      shift # past argument
      ;;
  esac
 done
-OBJECT="$1"
+
 if [ -z "$OBJECT" ]; then
  OBJECT="HEAD"
 fi
@@ -89,6 +104,10 @@ fi
 # tokens, the function will return 0 but echo a warning about the invalid token.
 validate_commit() {
  local COMMIT_HASH="$1"
  if [[ ${PROCESSED_COMMIT[$COMMIT_HASH]} ]]; then
    log "validate_commit for $COMMIT_HASH has already been validated"
    return 0
  fi
  log "validate_commit for $COMMIT_HASH"
  local TIMESTAMP_COMMIT_VERSION
@@ -275,9 +294,11 @@ validate_commit() {
  #assert that all extracted timestamps have been processed
  assert "[ $NUM_PROCESSED -eq $NUM_EXTRACTED ]" "All extracted token must be processed."
  PROCESSED_COMMIT[$COMMIT_HASH]=1
  if [ $NUM_VALID -gt 0 ]; then
    if [ $NUM_INVALID -gt 0 ]; then
-      echo_warning "Warning: While commit $COMMIT_HASH contains $NUM_VALID valid timestamp tokens and thus is considered proppely timestamped, it also contains $NUM_INVALID invalid timestamp tokens."
+      echo_warning "Warning: While commit $COMMIT_HASH contains $NUM_VALID valid timestamp tokens and thus is considered properly timestamped, it also contains $NUM_INVALID invalid timestamp tokens."
    fi
    DATE_STRING=$(date -d @"$EARLIEST_VALID_UNIX_TIME")
    echo_info "Commit $COMMIT_HASH, which timestamps commit $PARENT_HASH at $DATE_STRING, contains $NUM_VALID valid timestamp tokens."
@@ -293,14 +314,29 @@ validate_commit() {
 # param1: commit hash
 # returns: 0 if the validation of the commit and all its ancestors succeeded
 validate_commit_and_parents() {
  # If MAX_COMMITS_TO_CHECK is zero (or a negative number) then that is understood as "infinity".
  # So finish if we have reached the limit, and if the limit is not "infinity".
  NUM_COMMITS_CHECKED=${#PROCESSED_COMMIT[@]}
  if [[ ${NUM_COMMITS_CHECKED} -ge ${MAX_COMMITS_TO_CHECK} ]] && [[ ${MAX_COMMITS_TO_CHECK} -ge 1 ]]; then
    # enough commits have already been checked, so return early
    return 0;
  fi
  local COMMIT_HASH="$1"
  log "validate_commit_and_parents for $COMMIT_HASH"
  if [[ ${PROCESSED_PARENT[$COMMIT_HASH]} ]]; then
    log "parents for $COMMIT_HASH have already been validated"
    return 0;
  else
    PROCESSED_PARENT[$COMMIT_HASH]=1
  fi
  local ALL_PASSED=true
  if ! validate_commit "$COMMIT_HASH"; then
    ALL_PASSED=false
  fi
  NUM_COMMITS_CHECKED=${#PROCESSED_COMMIT[@]}
  local PARENTS=$(git cat-file -p "$COMMIT_HASH" | awk '/^$/{exit} /parent/ {print}' | sed 's/parent //')
  #iterate over all parents of commit
  if [ ! -z "$PARENTS" ]; then
    while read PARENT_HASH; do
@@ -309,7 +345,66 @@ validate_commit_and_parents() {
      fi
    done <<< $(printf "%s" "$PARENTS")
  fi
-  if [ "$ALL_PASSED"=true ]; then
+
  if [ "$ALL_PASSED" = true ]; then
    return 0
  fi
  return 1
 }
 # Recursive function to find all ancestors of commit
 # param1: commit hash
 # creates an array COMMITS, key is the commit hash, value is the commit time (Unix epoch seconds)
 # the array contains all commits found in all paths from the passed-in commit hash back to the root commit of the repo
 # the array is global so it can be accessed after the function returns
 find_all_commits() {
  local COMMIT_HASH="$1"
  log "find_all_commits for $COMMIT_HASH"
  # git show "ct" format returns the commit time as Unix epoch seconds
  COMMIT_TIME=$(git show --no-patch --format=%ct "$COMMIT_HASH")
  COMMITS[$COMMIT_HASH]="${COMMIT_TIME}"
  local PARENTS=$(git cat-file -p "$COMMIT_HASH" | awk '/^$/{exit} /parent/ {print}' | sed 's/parent //')
  # iterate over all parents of commit
  if [ ! -z "$PARENTS" ]; then
    while read PARENT_HASH; do
      if [[ ${COMMITS[$PARENT_HASH]} ]]; then
        log "commit $PARENT_HASH has already been processed"
      else
        find_all_commits "$PARENT_HASH"
      fi
    done <<< $(printf "%s" "$PARENTS")
  fi
 }
 # Validate the commits in the COMMITS array, up to MAX_COMMITS_TO_CHECK
 # returns: 0 if the validation of the commits succeeded
 validate_commits() {
  ALL_PASSED=true
  # create an associative array with keys using the Unix epoch commit time and value the commit hash
  # this array can be easily used to sort in (forward or reverse) order of time
  for HASH in "${!COMMITS[@]}"; do
    UNIX_EPOCH_TIME="${COMMITS[$HASH]}"
    # two commits could have the exact same Unix epoch in seconds
    # so make that unique by appending an "x" and the hash
    UNIQUE_KEY="${UNIX_EPOCH_TIME}x${HASH}"
    COMMIT_TIMES[$UNIQUE_KEY]="${HASH}"
  done
  # sort into reverse order
  SORTED_KEYS=($(printf "%s\n" "${!COMMIT_TIMES[@]}" | sort -r))
  # process the commits from latest time to oldest time
  ALL_PASSED=true
  for ENTRY in "${SORTED_KEYS[@]}"; do
    COMMIT_HASH=${COMMIT_TIMES[${ENTRY}]}
    log "${ENTRY} has value ${COMMIT_HASH}"
    NUM_COMMITS_CHECKED=${#PROCESSED_COMMIT[@]}
    if [[ ${NUM_COMMITS_CHECKED} -lt ${MAX_COMMITS_TO_CHECK} ]]; then
      if ! validate_commit "$COMMIT_HASH"; then
        ALL_PASSED=false
      fi
    fi
  done
  if [ "$ALL_PASSED" = true ]; then
    return 0
  fi
  return 1
@@ -326,10 +421,21 @@ echo ""
 echo_info "Validating timestamps. This may take a while..."
 echo ""
-if validate_commit_and_parents "$COMMIT_HASH"; then
+if [[ ${MAX_COMMITS_TO_CHECK} -ge 1 ]]; then
-  echo_success "Validation OK: All timestamped commits in the commit history of $COMMIT_HASH contain at least one valid timestamp."
+  find_all_commits "$COMMIT_HASH"
-  exit 0
+  if validate_commits; then
    echo_success "Validation OK: ${NUM_COMMITS_CHECKED} timestamped commits in the commit history of $COMMIT_HASH contain at least one valid timestamp."
    exit 0
  else
    echo_error "Validation Failed: There are timestamped commits in the commit history of $COMMIT_HASH which do not contain any valid timestamps."
    exit 1
  fi
 else
-  echo_error "Validation Failed: There are timestamped commits in the commit history of $COMMIT_HASH which do not contain any valid timestamps."
+  if validate_commit_and_parents "$COMMIT_HASH"; then
-  exit 1
+    echo_success "Validation OK: All timestamped commits in the commit history of $COMMIT_HASH contain at least one valid timestamp."
    exit 0
  else
    echo_error "Validation Failed: There are timestamped commits in the commit history of $COMMIT_HASH which do not contain any valid timestamps."
    exit 1
  fi
 fi
@@ -0,0 +1,26 @@
 #!/bin/bash
 #    Copyright (c) 2024 JankariTech UG
 #    Authors: Artur Neumann
 #    Script to check if the trustanchors have been changed
 TRUSTANCHOR_DIR="$1"
 EXPECTED_COMMIT_HASH="$2"
 if [[ $# -ne 2 ]]; then
    echo "Usage: $0 <trustanchor_dir> <expected_commit_hash>"
    exit 1
 fi
 if [ -z "$EXPECTED_COMMIT_HASH" ]; then
    echo "No expected hash provided"
    exit 1
 fi
 # get the sha256 hash of all files in the trustanchor directory
 ACTUAL_COMMIT_HASH=$(find "$TRUSTANCHOR_DIR" -type f -exec sha256sum {} \; | sort | sha256sum | cut -d ' ' -f 1)
 if [ "$EXPECTED_COMMIT_HASH" != "$ACTUAL_COMMIT_HASH" ]; then
    echo "The trustanchors have been changed, please review the provided hash"
    exit 1
 fi