Saudi NCA National Cryptographic Standards (NCS-1:2020) 6.2a: Key generation, registration and distribution

What does 6.2a require?

Secret and private keys must be generated so they cannot be predicted or biased, weak keys must not be used, and key pairs require prime generation with the extra mathematical properties the algorithms demand. Keys must be bound to their owner through a certificate issued by a trusted CA, with root certificates distributed to relying parties and signatories. Keys must be distributed securely to their users and remain under the users' control, transported with their confidentiality and authenticity protected, with all copies installed and stored securely; public keys are transported with authenticity protected by certificates, and private keys protected and authorised by the owner, a third party or the CA.