pub const ID_KP_CMC_RA: &str = "1.3.6.1.5.5.7.3.28";
id-kp-cmcRA OID (1.3.6.1.5.5.7.3.28) per RFC 6402 §3.2.
Registration Authority certificates used for CMC must include this EKU.