Thank you. This matches the unresolved distinction we are trying to clarify: requesting key attributes is different from having documented enforcement for software RSA keys in the Data Protection Keychain. Could Apple DTS confirm whether this exact combination is supported: a persistent software RSA-3072 key in DPK, effective private-key non-exportability, and signing-only use? We would also appreciate clarification of the scope of kSecKeyExtractable versus kSecAttrIsExtractable, and a supported verification method that does not attempt private-key export. If this combination is not supported for standard software DPK keys, an explicit clarification would help us choose an appropriate custody architecture rather than rely on unverified attributes. We have not generated keys or performed export experiments.