How to indicate certain credential configurations need oauth client attestation?

[awoie]

Perhaps this issue should be filed in a different repository.

Two questions:

• Should we define a mechanism that some of the credential configurations require oauth client attestation while others may not?
• Would it make sense to define a token endpoint auth method for oauth client attestation to indicate oauth client auth is supported, e.g., by including it in the token_endpoint_auth_methods_supported metadata?

[paulbastian]

The latter already exists, but I think there is no possible way to communicate so for a particular credential configuration.

[awoie]

Is it a possibility that some configurations might need an attestation, others don't?

[paulbastian]

The same applies to PKCE, Dpop and so on?