PKI cards on phones

A PKI card goes to a member’s CodeB Wallet. At a Windows PC with an NFC reader the phone then works as a smart card for certificates and Windows sign-in. Read/write PKI card: Windows creates the key and writes the certificate onto the phone itself. Read-only PKI card: right after it is collected, the phone fetches the member’s remote-signing certificate from this site (created if the member has none yet) for the card’s signature slot – the same key signs remotely, so it also stays on the server; self-signed today, so relying parties show an unknown signer. Revoking a read-only card stops the card only; the member’s remote-signing key and certificate stay until they are revoked separately. A Windows sign-in certificate on this card needs the CodeB PC software, which comes later. The card works only while the member has chosen it in the app with the phone unlocked. Test use only.