Ideally, we should send either to full uid@domain email, or include the issuer domain in this notification.  So that the downstream consumers don't have to guess what issuer this belongs to.

We could hard-code it in the downstream consumers but it seems nicer to do it here.