TLS 1.3 MUST NOT send its username in cleartext in the Identity Response.

[emanjon]

EAP-TLS 1.3 states

TLS 1.3 MUST NOT send its username in cleartext in the Identity Response.

Should clarify that this also apply if the identity is obtained in another fashion.

RFC 3748

       Identity Request is not required, and MAY be bypassed.  For
       example, the identity may not be required where it is determined
       by the port to which the peer has connected (leased lines,
       dedicated switch or dial-up ports), or where the identity is
       obtained in another fashion (via calling station identity or MAC
       address, in the Name field of the MD5-Challenge Response, etc.).