Question: In the context of Network Domain Security (NDS) Authentication Framework, what is a key characteristic of the direct cross-certification approach when setting up a tunnel between operators?
Option 1: It requires an initial step to cross-certify with a Bridge Certification Authority (CA) before each tunnel setup.
Option 2: It involves automatic cross-certification for all potential operator pairs at network initialization.
Option 3: The cross-certification operation is performed manually only when agreeing to set up a tunnel with another operator, as part of the legal and technical setup process.
Option 4: It is technically feasible only in GRX (Generalized Roaming eXchange) environments.
Explanation: The correct answer highlights that direct cross-certification is done manually at the time of agreeing to set up a tunnel between operators, as part of both legal and technical setup processes, eliminating the need for an initial cross-certification step with a Bridge CA.