No, two are marked signing and one encryption. I tried compressing them down to a single KeyDescriptor with no use, but to no use. All these changes were resulting in changed behavior, so I believe this is the only occurrence of that entityID. I'll keep digging until I find it.