verification-key-map might need an extension point and maybe should support DIDs today?

[henkbirkholz]

Maybe something like this (the bytes anticipate CRIs that support DIDs as discussed in CORE just this week.

verification-key-map = {
  comid.key => pkix-base64-key-type
  ? comid.keychain => [ + pkix-base64-cert-type ]
  ? did-uri => tstr / bytes
  $$verification-key-map-extension
}

[nedmsmith]

There was a previous issue related to identities and DIDs. Does this tie into that other thread?

[thomas-fossati]

since we are at it, should we also consider a label (a la kid in JWT/CWT)?

[nedmsmith]

key id is generally a good practice. The challenge may be that the entity that creates comid.key also creates kid/key-label. If the verification-key-map creator is different from the key creator then it isn't clear that verification-key-map creator isn't renaming/relabeling the key.

[thomas-fossati]

key id is generally a good practice. The challenge may be that the entity that creates comid.key also creates kid/key-label. If the verification-key-map creator is different from the key creator then it isn't clear that verification-key-map creator isn't renaming/relabeling the key.

yeah, you're right. Not as straightforward as I hoped for :-)

[henkbirkholz]

verification-key-map = {
  comid.key => pkix-base64-key-type / did-uri
  ? comid.keychain => [ + pkix-base64-cert-type ]
  $$verification-key-map-extension
}