Merge branch 'ca-identity-constraint'