Puppet also expects to do validation against the CN, that's how auth.conf rules work. So, this may be scored 9.3, but it seems like a nothingburger for us.