Support for UCCS/UJCS?

[laurencelundblade]

Seems like you'd want UCCS or UJCS EARs -- lots of B2B over TLS for attestation results I'd expect.

As written, there's no option for this because CWT/JWT is a requirement.

[thomas-fossati]

hi Laurence!

As written, there's no option for this because CWT/JWT is a requirement.

Always signing the EAR was a conscious choice to link strongly an AR to the verifier that was responsible for the appraisal. In cases where it is not necessary to carry the signature across (e.g., in multi-stage verification within the same trust boundary), it can be stripped away easily.