I don't really want to drill into what's happening with AMP, but I am skeptical of attempts to move from domains to some concept of real world entities with signing. We tried that with EV certs, but it turned out pretty easy, albeit expensive, for bad guys to get EV certs.