The documentation for pkinit_identities states:

    This option may be specified multiple
    times.  Each value is attempted in order until identity
    information is found and authentication is attempted.

This could be interpreted in several ways.  In reality, the loop in 
pkinit_identity_initialize() tries each value until one of them 
successfully parses, regardless of whether the parsed values point to 
valid identity information.  These don't seem like very useful 
semantics, but I can think of one useful scenarios: an ENV: value 
will fail to parse if the environment variable isn't defined, so the 
first value could specify an override variable and the second value 
could specify a default.  (A PKCS11: value will also fail to parse if 
the library has no PKCS11 support, but that doesn't seem very 
useful.)

Other possible semantics for multiple pkinit_identities values 
include:

* Try to load all of them into the creds array and then use identity 
selection to pick one.  This meaning doesn't match the current 
documentation but hews closely to what we do for multiple creds 
obtained via a single DIR: value.

* Try each value until not just until one of them parses, but until 
one of them results in a PKINIT request (as indicated by "and 
authentication is attempted" in the documentation).

Both approaches would require substantial code changes and (as far as 
I can remember) nobody has really asked for either of them, so 
clarifying the documentation may be the best change for now.