Clarify support for claims-based bound credentials

[paulbastian]

Text around cnf parameter is not very clear to me. Is the support for cnf mandatory or the presense of the claim?

[Sakurann]

right now, cnf claim is a must.

[Sakurann]

i added this statement in PR #187
does it help?

Any of the flows defined in this specification MUST be used with cryptographic holder binding. However, this does not prevent credentials with other kind of holder bindings (claim-based and biometrics-based holder binding) to be used with the flows defined in this specification

[jogu]

Discussed on today's WG call:

Consensus that we should allow claims-bound credentials in HAIP.

We'd need to make the 'must' for cnf in the SD-JWT VC section conditional.

May need security considerations around them if there's not already one in VP, so that verifiers are clear they need to separately validate the identity.

Torsten to try drafting up the changes that would be required so WG can evaluate if that's the best approach, or if a separate profile for claims-bound credentials is better.

[tlodderstedt]

created #210