X.509 certificate-based hierarchical resource delegation (extracted from Albatross)
new