An ACME directory that anyone can register at is an enrollment interface that anyone can knock on. For an internal CA that is rarely what you meant — so in goca, registration.mode is eab-required by default, and open is an explicit exception you write down.
External Account Binding ties an ACME account to a credential you minted first. EAB credentials are ordinary enrollment credentials (frame 46) wearing their protocol's shape: the kid, endpoint, template and identifier scope, expiry and use policy are all verified by the core, not the head. The secret is shown once at mint; for ACME the core keeps a KEK-wrapped MAC key, because the protocol requires recomputing a MAC rather than comparing a hash. The head forwards presented evidence inward and never holds the MAC key — a popped ACME head cannot mint valid registrations.
Redemption yields a stable requestor identity (like scep:devices/<credential-id> in the SCEP example's shape) that template allowlists, approvals and audit all use — so "which machine got this certificate" traces back to which credential was redeemed, not to an anonymous account number.
Now I can say who may register at my ACME directory — and prove the head never held the secret.