See: https://github.com/uspki/policies/blob/master/certificate-policy.md#323-authentication-of-individual-identity
As far as I understand, this CP is for issuing device certificates, and not certificates to humans. The only time I assume individuals are authenticated, is if they are a POC/device sponsor/etc.
If this is the case, the policy requirements for "Authentication of individual identity" appears limited, and based on traditional/analog means derived in 1876. ( I.e., photo ID ) Further, is there any value of understanding the Individual's address?
The current language is below:
If an Applicant subject to this Section is a natural person, then the CA SHALL verify the Applicant's name, Applicant's address, and the authenticity of the certificate request.
The CA SHALL verify the Applicant's name using a legible copy, which discernibly shows the Applicant's face, of at least one currently valid government-issued photo ID (passport, drivers license, military ID, national ID, or equivalent document type). The CA SHALL inspect the copy for any indication of alteration or falsification.
The CA SHALL verify the Applicant's address using a form of identification that the CA determines to be reliable, such as a government ID, utility bill, or bank or credit card statement. The CA MAY rely on the same government-issued ID that was used to verify the Applicant's name.
The CA SHALL verify the certificate request with the Applicant using a Reliable Method of Communication.
We have spent a lot of time and public funds for PIV and PIV-I credentials. Could a digital signature from any of those credentials suffice for this requirement? Further, consider an automated certificate management protocol, such as ACME, and authentication of the administrator. See:
https://github.com/letsencrypt/acme-spec/blob/master/draft-barnes-acme.md
Adding emphasis on the item below:
Receive CA challenge at a (hopefully) administrator-controlled e-mail address corresponding to the domain and then respond to it on the CA's web page.
Could the administrator benefit by receiving an encrypted email from the CA that can only be decrypted using the PIV credential? It does add privacy, and authentication of individual identity, to the automated process for first time retrieval. Updates/Rekeys could then be fully automated with much less concern.