Making sure Principal is same name as requester

I'd like to add a feature to make sure a requester can't request a cert for a Principal that has a different user's name (e.g. if Alice is an AuthorizedRequester, she can't request a cert for `Bob@*`).

It doesn't look like this is possible currently. And it also looks like the person who requested the cert in the first place is not stored anywhere persistently.

If that's correct, it seems like I would have to do some surgery. I.e., add a field to the `certRequest` struct to persistently store **who requested that cert** in the first place.

Is this accurate? Any thoughts here?