QUESTION issuing certificates + checking the requesting party

So in the `Issuing certificates` section of [Nick's CF blog post](https://blog.cloudflare.com/how-to-build-your-own-public-key-infrastructure/) he writes, "Given a CSR, a certificate authority can create a certificate. First, it verifies that the requestor has control over the associated private key. It does this by checking the CSR’s signature. **Then the CA will check to see if the requesting party should be given a certificate and which domains/IPs it should be valid for. This can be done with a database lookup or through a registration authority.** If everything checks out, the CA uses its private key to create and sign the certificate to send back to the requestor."

Is there any further documentation or blog posts on how this would work? I'm imaging a dictionary/table of sorts mapping incoming IP (the requestor) to a list of domains it is allowed to be given a signed cert of e.g. "172.1.2.3":["www.foo.com","www.bar.com"]. But this functionality doesn't exist in /sign or /authsign, right?

p.s. I am not that great at Go so I'm sorry I can't make PRs for this awesome project. :(

Thanks in advanced for your help.