Did you finally update CACNG to manage the full list of active CAC/PIV I and II cards?  Last time I checked, I still couldn't get it to handle at least one cardstock in active issuance.

Also, how does CACNG resolve the PIN-Always rule conflict on the Digital Signature key? 

For those who care:

The PIV data model applies a PIN-Always ACL on the (optional) digital signature key; PIN-Once is used for the PIV authentication key, and the PIV middleware specification requires collecting the PIN from the user for every action using a key with a PIN-Always ACL.  This means that when using the DoD-Signature certificate for, e.g., website authN, a PIV-compliant middleware (like PIV.tokend) will ask for the PIN for every private key operation--a real nuisance, I assure you.  :) 

The CAC data model and DoD Middleware Specification have no such rule, which meant it was effectively PIN-Once.  Much more usable.

This is a clear problem for middleware that claims compliance with PIV and CAC specifications.  You can't do both at the same time.  :)

I believe NIST is considering more explicit guidance re: middleware and PIN-Always; e.g., allowing an acknowledgement vs. PIN collection, but AFAIK this hasn't made it into the SPs yet.

-- T