[Wimse] Discussing motivations and drawbacks for multiple service attestation

[Daniel Feldman <[e-mail]>]

It was great seeing everyone at the interim meeting yesterday and Justin's
overview at today's SPIFFE community meeting!

As I understand it, one initial goal of WIMSE was to develop a standard for
including a sequence of multiple service identity attestations, one for
each hop taken by a request. Currently, I believe this goal is not spelled
out formally in any working documents. It’s still early, and we definitely
can change course as we go through the working group process.

I am keen to compile a list of reasons why users might want this multiple
service attestation feature. For instance:

Authorization: Establish different policies based on the request's original
origin.
Node Identity: Ensure each hop executed on a verified node.
Supply Chain Identity: Verify each service's artifact signature per hop.
Auditing or Forensics: Trace the request's hop sequence for later analysis.
Binding User Identity: Prevent intermediary services from altering user
identities embedded in a request.
Performance Tracing: Use as a performance tracing mechanism.
Signing Async Requests: Signing requests that are processed later through
message queues.
Delegating Privileges: Similar to AWS Presigned Requests.

And also reasons users would NOT want to do this:

Increased implementation complexity
Compute time (adding a crypto signature at each hop may be expensive)
HTTP headers may get too big to conveniently process
Lack of support in HTTP client libraries, servers, gRPC, and other tooling
Reduced architectural separation of concerns between different microservices

Having a solid understanding of the pros and cons of this approach would
really help with getting people excited about the WIMSE project. I'd be
really interested in hearing additional bullet points in either list.

Looking forward to your thoughts!

Cheers, Daniel Feldman