JWK keys and key sets are referenced in the specification but there is no formal reference to RFC 7517 (unlike OIDC4VCI and SIOPv2)