No explainer written for this spec yet. The summary, relations and documented support below are maintained.
A canonical URI-based identifier that names a workload within a trust domain, to be carried in X.509 certificates and JWT-based tokens for authentication, authorization and policy.