Two users need to send each other emails over unsecured channels. The system should support the principle of non-repudiation. Winch of the following should be used to sign the users' certificates?

A Registration Authority (RA) primarily handles identity verification and processing certificate requests on behalf of a CA, but it does not have the authority to sign or issue certificates itself.

A Certificate Authority (CA) is the trusted entity in a Public Key Infrastructure (PKI) responsible for issuing and digitally signing user certificates. This signing process binds a user's identity to their public key, establishing trust necessary for digital signatures that provide non-repudiation in email exchanges.

A Certificate Revocation List (CRL) is a list published by a CA that contains certificates that have been revoked, used for checking certificate validity rather than signing new ones.

A Certificate Signing Request (CSR) is a request submitted to a CA for a digital certificate, containing the public key and other identifying information, and is processed *by* the CA, not an entity that performs signing.