Creation Time and Expiration Time do not allow for clock skew

[richanna]

The processing instructions for Creation Time and Expiration Time imply that verifiers are not permitted to account for clock skew during signature verification.

[ioggstream]

This can safely be fixed adding a nbf-like claim, so that the signer remains in control of the signature validity. This is especially important if the signature is created with the signer's private key.

imho this kind of document should not define a clock-skew tolerance threshold, and implementors shoud be suggested to fix their clocks.

There may be corner cases (eg. IoT/disconnected devices ) that we should address properly