ISO8601 or RFC3339 for creation/expiration dates?

[Geal]

RFC 3339 might be simpler

[tarcieri]

I've used RFC 3339 in all of my stuff. For binary formats I use TAI64N.

[KellerFuchs]

I'd rather not have something which requires understanding timezones and DST in order to compare dates, as that's a good way to have different components of a system interpreting a given timestamp differently (for instance, even with the same implementation of biscuit, you could disagreements between systems using a different version of tzdata)

TAI64 (and TAI64N) have the advantage of simplicity: it is nigh-impossible to fuck up the timestamp comparison, as it is pretty-much just integer comparison.
I think it is reasonable to use TAI64, but TAI64N might be a better choice: we likely don't care about the 32b overhead, all usecases satisfied by TAI64 still work with higher-precision, and it would ruin someone's day to only provide TAI64 if they care about sub-second timing.

[clementd-fretlink]

TAI64N seems sensible indeed (as long as the biscuit libraries give an ergonomic way to specify durations).