No you’re right. The ARF just ignored that constraint and intentionally built in a back door here. From the linked article:
However, the current ARF stipulates that law enforcement authorities can retroactively trace pseudonyms back to their legal identity. The provisions therefore „strongly contradicts the legal requirements,“ epicenter.works writes.
It’s impossible to do without signing the with the valid cert. I think destroying the anonymity is the point