Three PKI operations questions: Why should a key pair generated inside a smartcard (private key never leaves the card) be used for signing but not for encryption? What goes wrong if a CA can no longer issue CRLs? And why can two people exchange their certificates by ordinary, unprotected e-mail?

No backup of the card key means lost card = lost encrypted data. Without CRLs, revoked certificates look valid: you may encrypt for an attacker or accept forged signatures. Certificates need no protection because they are public and already signed by the CA.

Smartcard key, signing only: if the private key exists only on the card, there is no backup. Lose or break the card and everything encrypted to that key is unreadable forever. For signatures this is harmless: you get a new card and a new key, and old signatures stay verifiable with the old certificate.

No more CRLs: applications can no longer check whether a certificate has been revoked.

• Encryption: you might encrypt data with a revoked public key whose private key is in an attacker's hands.
• Signature verification: signatures made with a stolen, revoked key are no longer recognised as forged.

Exchanging certificates:

• No encryption needed: a certificate contains only the public key and identity data, which are public anyway.
• No extra signature needed: the certificate already carries the CA's signature, which proves its authenticity and integrity.

Related rule: a signing application must check the signer's own certificate chain before creating a signature. A revoked certificate can mean the person is no longer authorised (e.g. left the company) or that the private key was stolen, and in both cases no signature may be created. That is also why signed documents carry the user, intermediate and root certificates: the verifier needs each one to check the next.