I have a question regarding Swedish gov eID (but I guess it is a pki/smart card general question); Why is there two certificates/keys on the card?
In Sweden you can have a "citizen electronic ID" on smart card (issuer Telia). The smart card have two certificates with different keys and different key-usages. One certificate is for "authentication/encryption" and one is for "digital signing" (key-usage=non-repudiation). As I understand it isn't possible to export the private key for any of the certificates.
My question is why are we using two certificates/keys? Why can't we just have one key/certificate that have support for both purposes (encryption/signing). I understand the principle that it´s good to have the option to export a key which is used for encryption (and vice verse - not able to export the key for signing)... And it would have make sense if the key for the authentication/encryption certificate would have been exportable...