Currently the identity selected for the handshake at the Start state. This could be made more flexible, in particular for the initiator:

• at the initiator side, it could choose which identity to use in the handshake after learning CRED_R, i.e., after process_message_2a
• at the responder, I am not sure it makes a difference, as it discloses its identity before learning CRED_I. Nevertheless, the responder's identity is really only needed at prepare_message_2