mention that key binding key can be correlatable in batching

[bc-pi]

It might be obvious to some/many but I think it's worth mentioning that the key binding key needs to be unique per SD-JWT when using batch issuance to try and get verifier/verifier unthinkably. I feel like I've seen it come up in a few discussions recently and sometimes stated like it was a new discovery. Having just a mention of it in the draft could be helpful guidance/reminder and also preempt criticism that it was somehow not known.

Maybe just a few words in https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-05.html#name-unlinkability

[Sakurann]

making it clearer would be nice

[paulbastian]

In batch issued credentials it might make sense to also think about iat/exp dates Either these should be:

• round up/down to certain timepoints, e.g. 24h UTC times giving a better herd anonymity
• randomize the timepoints within a certain range

[Sakurann]

PR merged