mdoc Reader Require EKU
Recognizes only reader certificates with the ISO/IEC 18013-5 reader authentication extended key usage (1.0.18013.5.1.6), so a certificate issued for another role under mdocReaderRoots isn't taken for a reader's.