SignedData (applied by the CA)
        PKIResponse
          controlSequence (Transaction ID, Sender Nonce, Recipient
                           Nonce, Batch Response)
          cmsSequence
            SignedData (applied by CA and includes returned
                        certificates)
              PKIResponse
                controlSequence (Transaction ID, Sender Nonce,
                                 Recipient Nonce)