[Rats] A few more comments on UCCS

[Laurence Lundblade <[e-mail]>]

Consider retitle 3.2 to Confidentiality (privacy these days is more about PII and non-tracking)


Please add text like this on converting UCCS to CWT and back again.

Note that the UCCS tag is NOT to be used on the map that contains the
claims in an actual CWT. A UCCS is distinct from a CWT. The correct
way to convert a UCCS to a CWT is to remove the UCCS tag (if it has
one), then sign or encrypt it with COSE and add the CWT tag if
necessary. To convert a CWT to a UCCS, remove the COSE protection,
then add the UCCS tag if necessary.


I think section 2 could be more direct in stating that a reason to use UCCS is because the characteristics of COSE / CWT don’t match the use case.  For example, it is not possible to use a TPM to sign a CWT, but it is possible to use to sign a UCCS.

LL