registrar
A dotted object identifier: recognizes only registrar certificates under registrarRoots with that extended key usage. Outside development, required when registrarRoots shares a trust anchor with another role's roots.