Scored both ways, the alternative first. These pages are read by the vendors they name, and a comparison that loses no rows is read as marketing.
The strongest workload identity model in production anywhere, with real attestation of what a workload is rather than what it claims. For machine-to-machine inside an infrastructure boundary it is better than anything here.
Identity of a workload, not authority of a principal. SPIFFE answers what is calling; it does not carry who authorised the call, on whose behalf, or up to what limit — and does not cross an organizational trust boundary by design.