question: private void verifyWithSeparateSigningKey ( X509Certificate cert , PublicKey prevKey , boolean signFlag , Set < X509Certificate > stackedCerts ) throws CertPathValidatorException { String msg = "revocation status" ; if ( debug != null ) { debug . println ( "RevocationChecker.verifyWithSeparateSigningKey()" + " ---checking " + msg + "..." ) ; } if ( ( stackedCerts != null ) && stackedCerts . contains ( cert ) ) { if ( debug != null ) { debug . println ( "RevocationChecker.verifyWithSeparateSigningKey()" + " circular dependency" ) ; } throw new CertPathValidatorException ( "Could not determine revocation status" , null , null , - 1 , BasicReason . UNDETERMINED_REVOCATION_STATUS ) ; } if ( ! signFlag ) { buildToNewKey ( cert , null , stackedCerts ) ; } else { buildToNewKey ( cert , prevKey , stackedCerts ) ; } }
target:  We have a cert whose revocation status couldn't be verified by a CRL issued by the cert that issued the CRL. See if we can find a valid CRL issued by a separate key that can verify the revocation status of this certificate. <p> Note that this does not provide support for indirect CRLs, only CRLs signed with a different key (but the same issuer name) as the certificate being checked.