I propose removing the x509-userToken as a required feature from the Embedded (maybe also from Standard) Profile.
Some arguments:
#1 - I have been told from product managers that they do not see the demand for this feature.
PKIs for user management are uncommon in plants. The effort to implement and test, however, is considered significant (engineering, user database structure).

#2 - I have heard that – although required in these profiles - it is rarely implemented.
Even applications that are certified for Embedded or Standard may not have this feature, because there are no tests yet.
If we add these tests now, newly certified products could fail where existing ones passed -> unfair.

#3 - we are just preparing yet another token (JWT) which will likely become our favorite.

Removal from a profile should have no side effects. I don't even see the need for an ERRATA.
We still have the facet as a separate entity. Once tests are available they can be run against the stand-alone facet.