My thought on the CDC is that the SteriPen may not kill the cysts.
I've been reading up more on this today. UV irradiation (254nm, like the Steripen) does inactivate the crypto cysts, preventing sporolation or excystation. Although most articles do mention in the discussion section the hypothetical possibility of some DNA repair mechanism eventually reactivating the cyst, all the studies I've read do conclude that the inactivation is irreversible.
Regarding the question about why the CDC says UV may not kill crypto, I ran across one comment for a household UV purification system regarding crypto. The kind of system that works with your kitchen faucet. It mentions that a particular countertop model is not really recommended if you're worried about crypto because at the usual rate that household water pressure flows through the unit, any given volume of water may not be exposed to UV long enough to thoroughly inactivate any crypto cysts. However, with the Steripen, you are thoroughly exposing the water to UV, so I see no reason to think that it won't effectively kill any crypto cysts in the water.
And regarding the lack of a NSF certification, apparently the NSF protocol is rather specific and a UV product like the Steripen doesn't fit into the protocol, therefore it can't readily be tested by NSF. That's why Steripen advertises the fact that it passes the EPA standards for water purification. The EPA protocols require a similar level of purification as the NSF standards, but the protocols are flexible enough to accomodate a product like the Steripen. So, as I mentioned before, as long as the water isn't turbid or full of sediment, limiting the transmission of UV throughout the water to be purified, the Steripen should do a good job.
Actually, looking this stuff up was a good exercise for me since I do have a Steripen myself.