OCTET_STRING
if (!k5_der_get_value(in, OCTET_STRING, &ostr))
k5_der_add_value(&buf, OCTET_STRING, token->value,
uint8_t id = negHintsCompat ? SEQUENCE : OCTET_STRING;
k5_der_add_value(&buf, OCTET_STRING, token->value,
k5_der_add_value(&buf, OCTET_STRING, mic->value, mic->length);