I have to deal with certificate issued by the Swiss post office on USB tokens. There deliver two certificates on the same token: in their intended usage fields, one has "non repudiation" and the other ...