keytool does not report key usage.

SunIT will be using dual certificates per person, one for authentication/signing, and the other for encryption. They will have the same DN. keytool reports serial numbers, but there is no way to see which key is for object signing.

By reporting key usage, users will be able to select the appropriate certificate/key for their operation.

Tests were performed with certificates on a smartcard and accessed via PKCS#11.