non key-bound credentials

[paulbastian]

Right now, the specification says:

This specification assumes that a Verifiable Credential is always presented with a cryptographic proof of possession which can be a Verifiable Presentation.

This would exclude the possibility to send claim-bound credentials, e.g. diplomas as they are used today in the physical world or any VC equivalent to signed PDFs. See also oauth-wg/oauth-sd-jwt-vc#145

Even the W3C VP does not mandate a proof bound to a key.

Do we want to soften this requirement?

[c2bo]

I agree, I think there is value / use-cases for attestations without a cryptographic key binding

[awoie]

potential duplicate of #6