JWT proof typ, alg, aud, iat, nonce and single key reference

Requirement as recorded in the ProtocolSoup registry

A JWT proof has typ openid4vci-proof+jwt, alg that is neither none nor a MAC algorithm, aud equal to the Credential Issuer Identifier, required iat, nonce when the Issuer has a Nonce Endpoint, and exactly one of kid, jwk, or x5c as the key reference.

Self-test verdict

Tests

• TestCreateCredentialProofJWTUsesFinalAnonymousProofShape

  ./cmd/walletharness

  Pass

Implementation

• backend/cmd/walletharness/main.go
• backend/cmd/walletharness/haip_issuance.go

Related requirements