Integrity of the JWK used for Credential Response encryption - Option 1

[c2bo]

Closes #507

This is the option leveraging the key proofs to also transport the encryption key (with integrity protection)

[tplooker]

Have left a comment here, personally im not convinced that this approach is the right path forward #507 (comment)

[Sakurann]

WG discussion:

• sign credential request as a JWT
• current direction. need more discussion:
  • define how to obtain key to validate the signature on the credential request. two options are wallet attestation and DPoP key?
  • in HAIP, mandate DPoP?

[Sakurann]

WG discussion: @c2bo to do a PR with second option, signing the entire request using the key that is sufficiently associated to the wallet.

[jogu]

As per Kristina's comment above / on #540 , and further discussion on today's WG call - closing for now. We can revisit in the future. (And thanks to Christian for putting together these PRs so we had some clear options to discuss the pros & cons of - I think that really helped us reach a conclusion).