The current version states for StartSigningRequest:
This Method can be invoked by a configuration tool which has provided user credentials with necessary access permissions. It can also be invoked by the Application that owns the private key used to sign the CertificateRequest (e.g. the private key shall be the private key used to create the SecureChannel).

The description should be more explicit that the first signing request has to be done with user authentication and that follow up updates can use the application authentication of the registered application itself and the certificate signed by the CA.

But the main problem is that the current definition would not allow to update the private key which is the recommended behavior. The definition should clearly allow this if the request is sent through a SecureChannel established by the application with a CA signed certificate for itself. This would inlcude the Application URI check that is part of the normal OPC UA connection establishment.

This applies also to the FinishRequest.