It would be all too easy for a TTP to link the two based on a false identity. Penalties should be aimed at preventing transgressions in this weak area. The DTI paper in many ways puts the cart before the horse. It is trying to legislate into place a structure that will protect the user. This is to ignore the way Internet works and has developed, and why Internet has to date been such a success.
Internet is an organic system.
Novel ideas are tried. If they work they are quickly incorporated and become part of the 'net standard, if they fail they are just as quickly abandoned. The DTI paper is ignoring this mode of development, and is progressing in a vacuum as though the 'net does not exist. What is required is a legal framework that supports whatever security system develops within Internet itself. Licencing is not required.