Be more explicit around how Issuer signals that claim-based binding should be used/ no proof is required

[paulbastian]

The implementation consideration 14.2. Binding of the Credential without Cryptographic Key Binding or Claims-based Holder Binding should explain more explicitly how this is signaled by the Issuer / understood by the wallet, i.e. cryptographic_binding_methods_supported being absent.

[javereec]

I'm happy to do this one. Seems pretty straightforward change.

One thing that might be worth discussing is that you can indicate that you don't want cryptographic key binding by omitting the cryptographic_binding_methods_supported under credential_configurations_supported in the credential issuer metadata, but unless mistaken, there is no mechanism to indicate that you don't require claim-based binding either. Are we happy to leave that one implicit?

[paulbastian]

What use case do you imagine that has neither cryptographic nor claims based binding? Even a ticket is imo bound to some identifier/code

[Sakurann]

WG discussion:

• client behavior does not change once cryptographic_binding is not required.