The question is, will that be enough? If OFAC can demonstrate that even with such restrictions, sanctioned entities are frequently obtaining certificates, they may be forced to require account creation or something else as a means of limiting that.

They also likely would have to implement some kind of domain name screening, just like banks have to block transfers that mention "Havana" or "Tehran".

They are currently not doing anything, even ccTLD blocks. They have issued certificates for .kp domains this month and in August of last year.