two CA in one domain

tw h 

This is an old thread and your question is not the same as the original poster's, so I'll keep this short and in the original context of Active Directory Certificate Services (AD CS):

• AD CS does not support ED25519 (I'm assuming this is what you meant when you said "ED29919"), meaning there's nothing to discuss in relation to it;
• AD CS supports AES and ECDSA;
• You do not need two separate authorities in order to issue AES and ECDSA certificates - a single authority can issue both;
• Being able to issue both RSA and ECDSA has nothing to do with the signature on the root certificate;
• AD CS uses "templates" to issue certificates, and within the properties of each template are the settings that specify which provider and algorithm are issued when a client requests the issuance of a certificate based on that template (see example below);
• Only Windows domain-joined clients can make use of Active Directory group policy-based auto-enrolment (which optionally can handle renewal automation). Any other client has to have their certificate(s) manually renewed, in which case there is no concept of "knowing which authority to contact".

Some additional, general AD CS reading:

• Migrating a Certification Authority Key from a Cryptographic Service Provider (CSP) to a Key Storage Provider (KSP) | Microsoft Learn
• Prepare the CAPolicy.inf File | Microsoft Learn
• Configure server certificate auto-enrollment | Microsoft Learn

And a non-AD CS article for anyone wondering what ED25519 is:

• encryption - ECDSA vs ECDH vs Ed25519 vs Curve25519 - Information Security Stack Exchange

If AD CS does not meet your needs then I'm afraid I cannot provide any advice, as I only work with AD CS (and SCCM, but that's out of scope for this discussion) for enterprise certificate management automation.

Cheers,

Lain