Currently IPA only supports cert issuance to IPA user, host and
service principals. We would like to be able to support issuing
certs to external subjects.

"External" means an subject that is not an IPA user, host or service. It could be some other object in the IPA directory (e.g. KDC krbtgt principal) or an object that exists outside IPA directory, e.g. a trusted realm principal, ACME client, etc.

Each kind of internal and external subject will have a particular way to validate the CSR and authorise the request. An example ACL requirement for smart cards might be, "users in group scadmins can issue certs from CA sc with profile sc to trusted realm principals whose principal name matches regex "...". The CSR validator for this use case would have to ensure that the subject exists and that Subject DN and alternative names match the subject.

Related discussion: https://gist.github.com/frasertweedale/6093f2312d16b3958374cc15b55b4d63