Thank you for pointing this out. This is exactly what I’d hoped might exist someday.

Nope, that’s not what I’m looking for at all.

Nope, that does not cover certificate issuance for IP addresses in that range.

This is currently used to sign ROA. A rogue actor can easily work around that by including the original AS in the AS path of the announce.