Require `jwt` proof_type with did to be used for OID4VCI requests

[TimoGlastra]

We should define that jwt proofs with did based binding should be used for authorization requests. And not ldp_vp

[samuelmr]

Is this a requirement for an issuer using an issuer agent or a technical requirement for the issuer agent?

What would be the requirement text in the DIIP profile?

A DIIP-compliant issuer agent MUST use `jwt?  proofs with DID-based binding in authorization requests

or

An issuer MUST use `jwt?  proofs with DID-based binding in authorization requests

[TimoGlastra]

The HAIP spec just says:

The JWT proof type MUST be supported.

I think we can extend it to:

The JWT proof type with DID-based cryptographic binding MUST be supported in the credential endpoint

[samuelmr]

How about this?

Requirement: DIIP-compliant implementations MUST support The jwt proof type with a did:jwt as the value of the kid element.