* require TokenRequest to be enabled and configured
* bind ca.crt publisher to this feature rather than to TokenRequest