Hi,

apparently the keyUsage dataEncipherment is mandatory in EE certificates that are exchanging encrypted messages via 
GSISecureMessage.

The receiving entity's certificate must have the dataEncipherment keyUsage extension set iff keyUsage itself is set to 
to be a critical extension. This is the case for EE certificates adhering to the IGTF minimum  requirements AP Classic, 
so dataEncipherment needs to be in the set of allowed keyUsages to make GSISecureMessage work.

TTY,

Reimer