Enabling the "Establish Authenticators" step in an enrollment flow currently also requires the configuration option "Email Confirmation Mode" be set to something other than "None". The file CoPetitionsController.php includes this comment:

      // Only the enrollee can (currently) set up their authenticators. This requires

      // email confirmation to be enabled so that enrollee_token gets set. (Trying to

      // allow petitioner_token as well becomes complicated.)

CILogon subscribers use the EmailVerficationEnroller plugin for email verification for a better user experience and set the core email confirmation mode to be None. This prevents subscribers from also collecting authenticators like SSH keys during those enrollment flows.

The request for enhancement is to allow the establishment of authenticators during enrollment flows where email confirmation is set to None.