RevokeCert and DeleteCert were not registered in sealRequired, authRequired, or adminRequired method sets, so the auth interceptor never ran for those calls and CallerInfo arrived as nil, producing "authentication required". SignCSR had the same gap in sealRequired and authRequired. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>