A software developer wants to ensure that the application is verifying that a key is valid before establishing SSL connections with random remote hosts on the Internet. Which of the following should…

Escrowed keys are copies of cryptographic keys held by a third party for recovery purposes and are not involved in runtime SSL connection validation or certificate verification.

During an SSL/TLS handshake, a symmetric session key is negotiated and used to encrypt the actual data channel; the application code must handle and validate this SSL symmetric encryption key to properly establish and verify the secure connection.

A software code private key is used for code signing to verify software integrity and authenticity, not for validating SSL certificates of remote hosts during network connections.

While a remote server's public key is part of its certificate, simply having the public key does not provide a mechanism to verify whether that key/certificate is still valid or has been revoked; OCSP fills that role.

OCSP (Online Certificate Status Protocol) allows the application to query a certificate authority in real time to determine whether a remote server's certificate has been revoked, ensuring the key/certificate being presented is still valid before trusting the connection.