It's likely to be useful to support blocking issuance for IP address identifiers (both single and within prefixes) the same way we can block domain names.