[VoT] Updating the Draft

[Justin Richer <[e-mail]>]

I’m updating the draft based on the initial feedback we got from folks, both here on the list and at the BoF in Prague. The biggest change is adding a fourth core category: Primary Credential Management, and renaming the former “Credential Management / Credential Binding” category to Primary Credential Usage. 

- “usage” is meant to to convey the strength of verifiability of the credential itself by the IdP. 
- “management” is meant to capture the lifecycle of issuance, rotation, and revocation by the credential issuer (usually the IdP) and how “strongly” it gets bound to a specific account.

I’m also tightening down the definition of the syntax, such that the component name is a single ASCII letter (currently case-sensitive) and the value is a single alphanumeric ASCII character (currently case sensitive). 

I’m also adding a (nominal so far) IANA registry for the categories and their markers, and at least noting that “vot”, “vtr”, and “vtm” all need to be registered in the JWT Registry. There’s formal language for establishing these that we’ll use later if this gets picked up as an IETF standards track document.

Thanks for all the comments so far, and hopefully I’ll have another I-D for you all to throw rocks at within a week’s time.

 — Justin