I read through it this afternoon (skipping the policy language and crypto heavy sections). I have some quibbles about the presentation, but the design looks solid from a capability perspective.
The main thing I think is unnecessary is using DIDs. They probably went that way because they use long-lived keys instead of a different key pair per certificate.