The working group is still discussing how to close many related issues.
- - - - - + + ++ When iss is absent, and the issuer + is identified as a DID Subject, + the kid MUST be an absolute DID URL. +
+
+{
+ "issuer": "did:example:123"
+ // ...
+}
+
+
+{
+ "alg": "ES384",
+ "kid": "did:example:123#key-456
+}
+
+ + When iss is absent, and the holder + is identified as a DID Subject, + the kid MUST be an absolute DID URL. +
+
+{
+ "holder": "did:example:abc"
+ // ...
+}
+
+
+{
+ "alg": "ES384",
+ "kid": "did:example:abc#key-456
+}
+
+
+
+ + When iss is absent, and the issuer is identified as a [[URL]], + the kid MUST be an absolute [[URL]] to a verification method listed in a controller document. +
+ +
+{
+ "issuer": {
+ "id": "https://university.example/issuers/565049"
+ }
+ // ...
+}
+
+
+{
+ "alg": "ES384",
+ "kid": "https://university.example/issuers/565049#key-123
+}
+
+
+ + When the holder is identified as a [[URL]], + and iss is absent, + the kid MUST be an absolute [[URL]] to a verification method listed in a controller document. +
+
+{
+ "holder": {
+ "id": "https://university.example/issuers/565049"
+ }
+ // ...
+}
+
+
+{
+ "alg": "ES384",
+ "kid": "https://university.example/issuers/565049#key-123
+}
+
+
+
+
+ + When iss is a present, and is a [[URL]], + the kid MUST match a key discovered via JWT Issuer Metadata Request +
+ ++ This normative statement depends on a -00 IETF OAUTH WG Adopted draft. + This feature is at risk and will be removed from the specification if at least + two independent, interoperable implementations are not demonstrated. +
+In order to complete the verification process, a verifier needs to obtain the cryptographic keys used to secure the