Nice overview, although it seems to be missing one of the most important changes from AA to CA: AA uses signatures for challenge/responses, which are by definit

Nice overview, although it seems to be missing one of the most important changes from AA to CA: AA uses signatures for challenge/responses, which are by definition non-repudiable. This means that any second party with access to your passport can prove to any (unaffiliated/untrusted) third party that they had access to your passport and can even include something like a cryptographic timestamp to prove that they did so at a given point in time. There were even some experimental schemes explicitly making use of ICAO biometric passports as a "proof of personhood", as far as I remember, but given that the ICAO scheme does not have any notion of document holder consent (e.g. via a PIN or other means of authentication), there are also significant privacy and security problems. CA intentionally avoids all of that, since the risk of entities using ICAO passports as unintentional and insecure digital signature tokens was apparently deemed too high.