signatures: which parameters are tokens and which are quoted strings?

[llorllale]

The signature header parameters are missing normative text on whether they are tokens or quoted strings. Suggest including normative text in each parameter's definition in section 4.1 clearly indicating whether they are a quoted-string or a token.

Related: in agreement with the topic in appendix B.1.2, the definition for keyId should at minimum define illegal characters that would present obstacles to reasonable parsing algorithms. Suggest adding normative text that this parameter MUST NOT include commas (","), at minimum.

[msporny]

The original intent was that keyId is supposed to be a quoted string, because it could contain a URL, like a DID, or other random http URL.. Everything else that wasn't a number was supposed to be a quoted string as well. Agree that we should update the spec with this language making it more clear.

[jricher]

This should all be clear by the parameter definitions finalized in -03 and expanded in -04 -- in short, all the core ones are strings or numbers.