```suggestion - The value of `OID4VPDCAPIHandoverInfoHash` MUST comply with the W3C Subresource integrity format as defined in [!W3C.SRI] (see below), e.g., `sha256-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO`. The `OID4VPDCAPIHandoverInfo` structure has the following elements: - The first element MUST be the UTF-8 encoded string representing the `origin` of the Verifier to protect against MITM attacks. The value for `origin` MUST be the one the web platform or app platform asserted the request was made by. - The second element MUST be the UTF-8 encoded string value of the `client_id` request parameter if the request was signed for audience binding. For unsigned requests, the value for the `client_id` MUST be derived from the `origin` value. - The third element MUST be the UTF-8 encoded string value of the `nonce` request parameter to enable session binding. ```

As we had the naming discussion recently, do we want these values to be OPENID4VP... to avoid confusion with Object Identifiers?