This is the best explanation of the different Windows cryptography providers.
I struggled with CNG keys 3 years ago when setting up ADFS. I resolved it at the time by exporting keys and repackaging them with OpenSSL so I could re-import as legacy, but I never got to the bottom of the mess.
I'm now facing it again while setting up NDES. Your table of [template version | Ca operating system | Crypto providers supported] has made everything clear.
Thankyou for putting the time into this.