7.10.7 CreateSigningRequest
defines:
Servers shall support one active and one new key pair for each combination of certificateGroupId and certificateTypeId. If this Method is called multiple times with the same certificateGroupId and certificateTypeId then any previously generated new key pair, that has not been made active, is discarded. If a key pair is made active by a call to UpdateCertificate then the previously active key pair is deleted.

It is not clear that the "new key pair" is persisted and is independent of the Session. This is very important to ensure that it is still valid if it takes longer to get the signed certificate from the CA.

We should add the following:
The new key pair created with CreateSigningRequest shall be persisted and shall be available for UpdateCertificate even if it is called from a different Session.