Workload identity URI in other fields

[jsalowey]

The WIT URI appears in the subject of a cert and token, but shouild it also be used for the issuer of the token and the CA subject name of a certificate.

[yaronf]

Also potentially aud.

[bc-pi]

The WIT URI appears in the [...]

I am admittedly confused by what a "WIT URI" might be.

[PieterKas]

Commenting as an identity enthusiast as opposed to chair:

I like the idea of using the same identifier format for all entities, but I do wonder if that is necessary. For a Bring Your own PKI scenario it may not be possible to change the issuer identifier for the CA, and the aud laim may correspond to the aud claim in the access token instead of some other workload identity (not sure those are constrained to aud).