Question: In a Key Update Request and Response sequence, as per Network Domain Security (NDS) Authentication Framework (AF), what is distinct about the signing of the PKIMessage sent by the base station?
Option 1: The PKIMessage is signed with a newly generated private key not related to any previously used certificate.
Option 2: The PKIMessage is signed with the private key related to the last received operator-provided base station certificate.
Option 3: The PKIMessage is not signed, as authentication is assumed from the initialization process.
Option 4: The PKIMessage is signed with a shared group private key among all base stations.
Explanation: This is correct because, according to the specified security protocol for Key Update Request and Response, the base station must sign the PKIMessage with the private key associated with the most recently received operator-provided base station certificate. This ensures continuity of authentication and trust in the updated key exchange process, leveraging the existing trusted certificate framework.