Location trust boundary enforcement
TSI ensures location trust boundary enforcement through embedding the location properties into the certificate structure. If the claims don't match the x509_v3 CA extensions the Signing Service and TSI Vault Auth Plugin will reject the request.