"Prevent plaintext PINs from being returned by credential manager"

Hello,

I have three questions regarding the GPO setting "Prevent plaintext PINs
from being returned by credential manager" do? It is found under Computer
Configuration -> .. -> ADMX -> Windows Components -> Smartcard.

1. The explanation found in the group policy editor states that: "If you
enable this setting, credential manager does not return a plaintext PIN". The
question is then: To whom will it not return a plaintext PIN? To the LSA? To
the BaseCSP? To a random user asking for it?

2. When this setting is enabled, what encryption algorithm is used on the
PIN, and what key is used?

3. When this setting is enabled, smartcard login works fine. However,
smartcard enrollment does not work - when enrolling, the following message is
displayed after entering the smartcard PIN the first time in the enrollment
process: "Computer Policy prohibits performing this operation because the
card does not support the required level of security".
The question is: Why does login work with this setting, but not signing?

Thank you very much!