The key management entity (KME) authorized to create the privilege certificate for another KME.
Sources:
CNSSI 4009-2015
from
CNSSI 4005