An X.509 extension that restricts permitted key operations, such as digital signature or key encipherment.