There is next to no documentation in the IG for this extension, making it very difficult to evaluate its efficacy and appropriate usage. My remarks below are based on what I have been able to glean from discussions.

• The trustFrameworkType field, bound to codes for DirectTrust, CareQuality, CommonWell, etc., is redundant with the technique for HIE endpoint discovery shown in section 3.6 http://hl7.org/fhir/us/ndh/2023Sep/exchange-use-cases.html#discovery-a-hie-endpoint-via-the-ndh (although section 3.6 also needs work * see FHIR-42644). The latter technique, where membership in HIEs is reflected in OrganizationAffiliations, is more robust and maintainable than a code system.
• The intermediate and leaf certificates in the fields signedArtifact and publicCertificate are not needed for Endpoints within HIEs that manage private PKIs (e.g. eHealth Exchange, Carequality, DirectTrust and TEFCA). Organizations already have the public certificates through HIE onboarding; this is not something they discover at runtime. See this discussion: https://chat.fhir.org/#narrow/stream/283066-united-states.2Fnational-directory/topic/Requirements.20for.20trust.20communities.2Fframeworks
  • Is the remaining need for these certs only for Endpoints that are not part of any centrally managed PKI?

Based on the above, my hunch is that this entire extension is not needed for endpoints in the national HIEs like the ones I mentioned. I'd like to see guidance that reflects that.