After a recent internal breach, a company decided to regenerate and reissue all certificates used in the transmission of confidential information. The company places the greatest importance on confide

When a company requires both confidentiality and non-repudiation, dual key pairs are the standard solution: one key pair (typically a Key Encipherment certificate) handles asymmetric encryption and decryption of data or session keys to ensure confidentiality, while the second key pair (a Digital Signature certificate) is used to sign data, providing non-repudiation by proving the identity of the sender. This separation ensures that signing keys are never used for encryption, maintaining the integrity of non-repudiation and allowing key escrow for encryption keys without compromising signature keys.

Extended validation (EV) is a certificate issuance process related to identity verification by a CA, not a function of a second key pair used during data transmission.

Encrypting data twice with two separate key pairs does not double confidentiality or non-repudiation in any meaningful cryptographic sense; this misrepresents how dual key pairs function and conflates encryption strength with key quantity.

Separating key pairs by communication direction (internal vs. external) is not a standard PKI practice for addressing confidentiality and non-repudiation, and does not align with the stated security goals of the company.