kid restrictions for JSON headers and new kyu

[dwaite]

The definition of kid is binary in CBOR and string in JSON, with no mapping between the two defined.

I propose JWP kid is restricted to be a binary value represented in BASE64URI encoding. This will limit the ability give keys friendly names or names which correspond to some other system, e.g. GUIDs.

I also propose a new header parameter, kyu, for key URL, to represent keys which are not identified by identifying labels but by location. An example of kid in JWS being used this way would be DIDs.

[selfissued]

I don't see a practical reason to be able to map Key ID values between JWPs and CWPs. They will be different ecosystems.

In one case, I suggest that we recommend the use of JWK Thumbprint values as "kid" values. In the other, I suggest that we recommend the use of COSE_Key Thumbprint values as "kid" values.