Remove mention of unspecified key binding methods

[bifurcation]

The algorithm in Section 8.3 includes the following branch:

If Key Binding is provided by means not defined in this specification, verify the Key Binding according to the method used.

We should remove that branch. If an implementation is doing something outside this specification, their behavior can deviate arbitrarily from what the specification says. It's not the job of this specification to cover everything that a verifier might possibly do.

[bc-pi]

Indeed it's not the job of this specification to cover everything that a verifier might possibly do. But verifying key binding is important and the specification elsewhere discusses the possibility that the proof of possession could be accomplished by ways other than the KB JWT. As such, we felt that it deserved treatment in the validation steps.

[bifurcation]

On the one hand, KB is important. On the other hand, KB is optional. 🤔

What other discussion do you have in mind? I'm not finding it on a quick search through the document.

[bc-pi]

Alternatives to a Key Binding JWT for example

[bifurcation]

Yeah, we should delete that and Section 10 as well. They don't actually define anything, and they are harmful because they encourage divergent, non-interoperable implementations. If there are use cases that KB-JWT doesn't cover and needs to, we should accommodate them. If we don't need to accommodate them, we shouldn't.

[Sakurann]

discussed during the editor's call - agreed to remove specific references that allow additional key binding mechanisms, to encourage interoperability using the mechanisms defined in the spec and because even without the text those additional mechanisms are not precluded as spec makes it clear KB JWT is optional.

@danielfett to open a separate issue on updating section 9 to reflect most recent implementation experience.

[bc-pi]

PR #404 removes mention of unspecified key binding methods and the Enveloping SD-JWTs section

[bc-pi]

discussed during the editor's call - agreed to remove specific references that allow additional key binding mechanisms, to encourage interoperability using the mechanisms defined in the spec and because even without the text those additional mechanisms are not precluded as spec makes it clear KB JWT is optional.

PR https://github.com/oauth-wg/oauth-selective-disclosure-jwt/pull/404 does that

@danielfett to open a separate issue on updating section 9 to reflect most recent implementation experience.

And issue #403 is that.