Italian CNS: rewrite as "Italian CNS, CIE and digital signature"

[ale-rinaldi]

As requested in the review of OpenSC/OpenSC#3751 ("What I'd like to see would be some more
documentation in the OpenSC wiki about the different types of Italian CNS and CIE"), this rewrites
the Italian CNS page so that a user can work out which card they are holding and what OpenSC can do
with it.

What the page now answers

• Why there are so many different implementations. CNS is not a card model but a set of
  specifications — file system, APDU set and certificate profile — that every Italian public
  administration implements through its own procurement, choosing its own chip, manufacturer and CA.
• Is this token a CNS? By the authentication certificate profile: policy OID 1.3.76.16.2.1
  with its prescribed explicit text, clientAuth, digitalSignature without nonRepudiation, and
  the <fiscal code>/<card id>.<hash> commonName.
• Is my card supported? How itacns matches a card (15 historical bytes with CNS at offset 9),
  with a decoded ATR, plus a summary per card generation and the change that made each one work.
• Why can't I sign? The qualified-signature side normally does not appear, and the reason is in
  the specifications rather than in a driver: the file system specification standardises the
  existence of DF_DS but not its contents, and since its 2016 revision explicitly allows the
  signature to live in a dedicated Java applet, with DF_DS present but empty and the applet
  interface left to the vendor's middleware. This is the recurring subject of
  #2782, #3479 and similar reports.

Corrections to the previous text

• The claim that a CNS cannot be issued to a citizen who already holds a CIE is not correct: the
  technical rules only ask the citizen to declare they hold no CIE, and the preventive check that
  once existed applied to the CIE pilot municipalities until 2005 and was repealed in 2009.
• The keyset labelled CNS1 for IDEMIA 2021 cards actually carries their authentication
  certificate (PIN reference 0x10), not a signature one; the page says so explicitly to avoid the
  same confusion.
• ST 2021 and ACe/ACx 2021 were listed by third-party sources as needing proprietary middleware;
  they work since #2371 and #2483 respectively. Only ST 2022 is currently unrecognised (#3755).

Verification

The ATR, the certificate profile and the observation that only CNS0 is exposed were checked on a
real card (ST/Incard CNS in a Bit4id CKey4 token) with OpenSC 0.23.0; the file paths, keyset
layouts, PIN references and the actalis emulation being registered among the legacy emulators were
read from card-itacns.c, pkcs15-itacns.c, pkcs15-actalis.c and pkcs15-syn.c. Specification
statements are cited from the AgID documents linked in the page's References section.

Commits

1. the page rewrite;
2. Italian-Infocamere and Italian-signature-card-Actalis reduced to pointers, keeping their URLs
   alive and the facts recorded only there;
3. the Italian entries in Supported-hardware, including moving the Actalis cards out of
   "Unsupported smart cards". That last commit is the only editorial change to a page outside this
   topic and can be dropped on its own if you would rather keep that list as it is.

Support for the Bit4id Digital-DNA Key is referenced as in progress, pointing at OpenSC/OpenSC#3751;
the page should be updated once that lands.

🤖 Generated with Claude Code