I'm not sure anymore if we tested if matching by IssuerCARef with system-token client certificates.

If it relies on the issuer cert to be present in the NSS DB, it might not work out of the box.
See GetPEMEncodedIssuer in client_cert_resolver.cc

Note that this is not settable through the admin console so priority is not high.