v2: implement draft-hardt-httpbis-signature-key-08

[dickhardt]

The signature-key draft has moved to -08, which is not backward compatible with the -05 wire format this library (1.1.0) implements. @hellocoop/httpsig 2.0.0-alpha.2 already implements -08 and is the reference to match.

Needed for the Hellō Wallet mobile work (Wallet MULTI_SESSION_MOBILE_PLAN.md, cross-cutting Signature-Key -08 item):

1. Implement the -08 wire format as a v2 release (breaking; both hwk and jkt-jwt schemes)
2. Cross-verify against @hellocoop/httpsig 2.0.0-alpha.x (sign here, verify there, and vice versa)
3. The iOS app then bumps its SPM pin; the Wallet server runs a dual-accept window (-08 first, -05 fallback) until heartbeat telemetry shows no -05 signers remain — fielded app builds sign -05 and cannot be flag-dayed

🤖 Generated with Claude Code

https://claude.ai/code/session_01HwkJrWKDtRp8KrQXL9rfTz

[dickhardt]

Concrete -05 → -08 wire deltas, observed while building the Android (kotlin-httpsig) implementation and contract-testing it against @hellocoop/httpsig 2.0.0-alpha.2 and 1.x:

1. Every distributed JWK must carry a fully-specified alg (RFC 9864) — "Ed25519", not "EdDSA". v2 rejects delegation JWTs whose header.jwk or cnf.jwk lack it. For this library that means KeyDelegation.swift adds alg to both JWKs.
2. hwk must NOT carry kid (rejected by v2).
3. signature-key coverage is unconditionally enforced (v1's strictAAuth option removed).
4. sigkey param → Accept-Signature-Scheme / Accept-Signature-Alg headers; supported_algorithms removed from Signature-Error; new error codes unsupported_scheme, issuer_missing/issuer_mismatch.
5. Signature-Input must never emit an alg parameter (now normative).
6. Signature base, created, jkt-jwt serialization, and RFC 7638 thumbprints are unchanged — device identity is draft-stable.

Useful property confirmed by the cross-tests: the -08 shape verifies under v1 too (v1 ignores the alg members; only very old Node WebCrypto chokes on alg:"Ed25519" at OKP import — Node 22 accepts it). So clients can move to -08 ahead of servers adopting 2.x verification.

Reference harness: android/httpsig/cross-test/verify.mjs in the mobile repo's worktree-android branch — sign in Kotlin, verify with both JS library versions; the same sign-here-verify-there pattern is recommended for the Swift v2 work.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HwkJrWKDtRp8KrQXL9rfTz