So for orgs using PKCS the only things that are needed to be done are updating the cert connector to the version stated, adding the reg key and then after that any new/renewing certs are good to go but ones that need to be renewed a new PKCS would need pushing from Intune to force the certs out machines.
As it doesn't mention it I assume you do not need to add the OnPremSecurityIdentifier into the PKCS profile like you do with the SCEP option?
On some test devices we have done this on I can see in the user cert on the device after updating the Intune connector there is the 1.3.6.1.4.311.25.2 attribute now there is that all that needs to be in place to be ready and is there any real world test we can do to ensure its going to work come Feb when the changes come into effect? Sheetal__09