AD CS ESC12: YubiHSM KSP unauthorized CA-key use

ESC12 is the attack vector described for AD CS CAs whose CA key is held in a YubiHSM 2 and exposed through the YubiHSM Windows Key Storage Provider (KSP). In the reported configuration, the KSP does not authorize cryptographic requests by the calling Windows account and uses an AuthKeysetPassword stored under HKLM; a standard local account with logon access to the CA host can associate the public CA certificate with the HSM-backed key and ask the KSP to sign a certificate without exporting the private key. This is a KSP middleware and CA-host access-control weakness, not an AD CS template misconfiguration. Verify the deployed provider configuration, registry ACLs, and 32-bit/64-bit provider paths before treating it as applicable.