Add more disclaimers to get-cert, clean up

Author: crandmck

docs/conformance.mdx

@@ -45,25 +45,18 @@ C2PA maintains two trust lists:
 - [**C2PA trust list**](https://github.com/c2pa-org/conformance-public/blob/main/trust-list/C2PA-TRUST-LIST.pem): A list of X.509 certificate trust anchors (either root or subordinate certification authorities) that issue certificates to conforming generator products under the C2PA Certificate Policy.
 - [**C2PA time-stamping authority (TSA) trust list**](https://github.com/c2pa-org/conformance-public/blob/main/trust-list/C2PA-TSA-TRUST-LIST.pem): A list of X.509 certificate trust anchors (either root or subordinate certification authorities) that issue time-stamp signing certificates to TSAs.
 
-### Interim trust list
+### Interim trust list retirement
 
-With the introduction of the C2PA trust list, the existing [interim (temporary) trust list](trust-list.mdx) is being retired.
+With the introduction of the C2PA trust list, the existing [interim (temporary) trust list](trust-list.mdx) is being retired on the following timeline:
 
-### Timeline
+- **Through December 31, 2025**: The [interim trust list](trust-list.mdx) will remain operational. During this time:
+  - The [Verify site](https://contentcredentials.org/verify) will continue to display manifests signed by certificates on the interim trust list as trusted, but with a disclaimer that the manifests were made with an older version of the trust model.
+  - New certificates will continue to be added to the interim trust list when requested.
+  - Product developers are strongly encouraged to apply to the C2PA conformance program and use the official C2PA trust list.
+- **On January 1, 2026**: The interim trust list will be frozen:
+  - No new certificates will be added to the list, and no updates will be made.
+  - Existing certificates will remain valid for legacy support.
 
-**Through December 31, 2025**: The [temporary trust list](trust-list.mdx) will remain operational.
+Eventually, the certificates on the interim trust list will expire and will not be usable for signing. However, if content was signed during the interim trust list certificate's validity period, the content will always be considered valid against the legacy trust model.
 
-During this time:
-
-- The [Verify site](https://contentcredentials.org/verify) will continue to display manifests signed by certificates on the temporary trust list as trusted, but with a disclaimer that the manifests were made with an older version of the trust model.
-- New certificates will continue to be added to the temporary trust list when requested.
-- Product developers are strongly encouraged to apply to the C2PA conformance program and use the official C2PA trust list.
-
-**On January 1, 2026**: The temporary trust list will be frozen.
-
-- Existing certificates will remain valid for legacy support.
-- No new certificates will be added to the list, and no updates will be made.
-
-Eventually, the certificates on the temporary trust list will expire and will not be usable for signing. However, if content was signed during the temporary trust list certificate's validity period, the content will always be considered valid against the legacy trust model.
-
-Validator products are encouraged to begin distinguishing between Content Credentials signed with certificates on the temporary trust list (typically tied to Content Credentials specification version version 1.4) and those from conforming products using the official C2PA trust list.
+Validator products are encouraged to begin distinguishing between Content Credentials signed with certificates on the interim trust list (typically tied to Content Credentials specification version version 1.4) and those from conforming products using the official C2PA trust list.

docs/signing/get-cert.md

@@ -3,7 +3,7 @@ id: get-cert
 title: Getting a signing certificate
 ---
 
-:::note Important
+:::warning Important
 Best practices for handling keys and certificates are beyond the scope of this documentation.  Always protect your private keys with the highest level of security; for example, never share them through insecure channels such as email.
 :::
 
@@ -12,6 +12,10 @@ To sign manifest claims, you must have an X.509 v3 security certificate and key
 
 ## Purchasing a certificate
 
+:::note
+The [C2PA conformance program](https://c2pa.org/conformance/) establishes the requirements governing the issuance of C2PA claim signing certificates for use by product developers. See [C2PA certificate policy](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Certificate%20Policy.pdf) for more information.
+:::
+
 The process to purchase a certificate and key is different for each CA: You might be able to simply click a "Buy" button on the CA's website. Or your can make your own key and use it to create a certificate signing request (CSR) that you send to the CA. Regardless of the process, what you get back is a signed certificate that you use to create a certificate chain.
 
 The certificate chain starts with the certificate from the last tool that signed the manifest (known as the "end-entity") followed by the certificate that signed it, and so on, back to the original CA issuer. This enables a validating application to determine that the manifest is valid because the certificate chain goes back to a trusted root certificate authority.
@@ -23,9 +27,7 @@ The C2PA specification requires that an "end entity" signing certificate must be
 - An S/MIME email certificate (`id-kp-emailProtection` EKU). This is usually the simplest and least expensive option.
 - A document signing certificate (`id-kp-documentSigning` EKU). Obtaining these kinds of certificates typically have more stringent requirements (like proving your identity) and costs more.
 
-:::note
 For more details, see [Certificate requirements](#certificate-requirements) below.
-:::
 
 ### Certificate authorities (CAs)
 
@@ -53,6 +55,10 @@ You sign the CSR with your private key; this proves to the CA that you have cont
 
 ## Certificate requirements
 
+:::note
+The information in this section is superseded by the [C2PA certificate policy](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Certificate%20Policy.pdf) the that establishes the requirements governing the issuance of C2PA claim signing certificates. 
+:::
+
 A signing certificate and key (credentials) must conform to the requirements in the [C2PA specification X.509 Certificates section](https://c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html#x509_certificates); specifically, it must:
 
 - Follow the public key infrastructure (PKI) X.509 V3 specification.

docs/trust-list.mdx

@@ -18,16 +18,20 @@ The C2PA **[Verify tool](https://contentcredentials.org/verify)** uses a list of
 
 Conversely, if the Content Credential was signed by a known certificate, the Verify tool will display the [name of the certificate owner and time of the claim signature](verify.mdx#title-and-signing-information).
 
+## Deprecation timeline
+
 :::note
 Currently, **[Verify](https://contentcredentials.org/verify)** uses the interim trust list described here (also referred to as the _temporary trust list_), but Verify will be updated soon to use the official [C2PA trust list](conformance.mdx#c2pa-trust-lists).
 :::
 
-## Deprecation timeline
-
 The interim trust list (also known as the _temporary trust list_) will remain operational **through December 31, 2025**. During this time, C2PA will continue to accept new certificates following the process described below. At some point, the Verify site will distinguish between Content Credentials from conforming products and those signed using certificates on the interim trust list.
 
 On **January 1, 2026**, the interim trust list will be frozen: C2PA will not add any new entries or make updates. Existing certificates will remain valid, but eventually, those certificates will expire and no longer be usable for signing. However, if content was signed during the certificate's validity period, the content will always be considered valid against the interim trust list.
 
+:::tip
+For more information about conformance, see [C2PA conformance program](conformance.mdx).
+:::
+
 ## Interim known certificate list
 
 The Verify site hosts the following files that it uses to [validate signing certificates](https://c2pa.org/specifications/specifications/2.0/specs/C2PA_Specification.html#_c2pa_signers). Together, these files form the _interim known certificate list_: