We do now include both "Digital signature" and "Key encipherment" as default change this to only include digital signature flag as default.
Fixed in commit 25610.
Looks good.