KMF_KU_ENCRYPT_DATA
ret = check_key_usage(handle, cert, KMF_KU_ENCRYPT_DATA);
case KMF_KU_ENCRYPT_DATA: