Windows Hello for Business certificate trust deployments use AD FS as the CRA. The CRA enrolls for an enrollment agent certificate. Once the CRA verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the CA. The Windows Hello...
or reclaim, the assets in the trust. There are exceptions including alter-ego trusts and joint partner trusts. But otherwise, the rules make revocable trusts increasingly common in the U.S., while difficult to use in Canada.