Isn't this the whole point of SPIRE/SPIFFE?. A workload can identify itself to a different trust domain as long as there's trust between the different domains and a policy that allows it.