- set environment in protect-tool (#548528) - do not reject OCSP signing certs without keyUsage (#720174)