...
2nd - Possession or inherence (what about knowledge from device-based out-of-band communication, software tokens, etc?)
scenario?
with whom?
vetting fo a NREN? local users (and existing iDs intended for local use) or international ones (passports, are there others?) what about NREN/group remotely vetting a foreigner - is this a marginal or key case?