code: static boolean certCanSignCrl(X509Certificate cert) {
          // if the cert doesn't include the key usage ext, or
          // the key usage ext asserts cRLSigning, return true,
          // otherwise return false.
          boolean[] keyUsage = cert.getKeyUsage();
          if (keyUsage != null) {
              return keyUsage[6];
          }
          return false;
      }
docs: Checks that a cert can be used to verify a CRL.
  
  @param cert an X509Certificate to check
  @return a boolean specifying if the cert is allowed to vouch for the
  validity of a CRL