It's derived from the key like in https://pkg.go.dev/github.com/nspcc-dev/neofs-sdk-go/bearer#ResolveIssuer, but this defeats `neofsid` or any other non-standard account mapping scheme.