The spec has evolved from did:web to being flexible about the types of identity a transparency service may support.
It uses x.509 as a primary example, but could be confusing whether x.509 must be used, or rather when it's used, these are the properties that MUST or SHOULD be set.

This issue tracks extracting x.509 to an identity profile, which could be defined in the same architecture doc. And, making it clear that other identity types CAN be used, eliminating the need to follow the x.509 requirements.