I'm worried about one thing with this in practice. We've had issuers complain that restricting the issuer url to the origin in the 0.5 spec was unfair, because in a university or something, you might have totally separate departments issuing badges from the same origin but different URLs, and they'd know nothing about each other. Given that scenario, I could imagine two such issuers ending up with the same GUIDs for their badges.