The Profile struct now supports optional OCSPServer and
IssuingCertificateURL fields. When populated, these are set on the
x509.Certificate template as Authority Information Access extensions
before signing. Empty slices are omitted.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>