Changes

** This MUST be the default value in tools provided by the CA.

** Certificate subscribers are not required to provide a revocation reason, unless their private key has been compromised.

* keyCompromise (RFC 5280 CRLReason #1)

** The certificate subscriber MUST choose the "keyCompromise" revocation reason when they become aware of or have reason to believe that the private key of their certificate has been compromised, e.g. an unauthorized person has had access to the private key of their certificate.