Section 36

If the subscriber generates the key pair whose public key is to be listed in a certificate issued by a certification authority and accepted by the subscriber, the subscriber shall generate that key pair using a trustworthy system.

This section shall not apply to a subscriber who generates the key pair using a system approved by the certification authority.