Allocate now checks if pubkey already has an identity and returns it. Prevents duplicate identities for same pubkey (was causing random number assignment on cert auth). GetByPubKey returns identity with highest CreatedAt for deterministic behavior.