S01-BP: Yes
Rationale
TCPCL requires certification-path and NODE-ID validation, but not a public CA. The profile selects participant-operated CAs, locally exchanged trust and no online OCSP. BPSec keys are provisioned locally. No separate mandatory third-party authority is selected; identifier allocation remains S03. Profile inference.
Assessment method
Documentary analysis
Source context
Primary specification / selected profile
Outstanding qualification
For S01/S02, pin TCPCL/BPSec implementations; verify locally exchanged roots, NODE-ID matching, EKU and rejection of untrusted or mismatched identities without online services. BPSec leaves key management to network management (RFC 9172 section 6); the selected local provisioning must be exercised. No execution performed. https://datatracker.ietf.org/doc/html/rfc9172#section-6