Code change:
array instead of retrieving the respective Type Metadata elsewhere as follows: <ins> 6.4. An SD-JWT VC type can extend another type.  The extended type is identified by the URI in the property.  Consumers MUST retrieve and process Type Metadata for the extended type before processing the Type Metadata for the extending type. The extended type MAY itself extend another type.  This can be used to create a chain or hierarchy of types.  The security considerations described in circular-extends apply in order to avoid problems with circular dependencies. 6.5. 6.5.1. Schemas for Verifiable Credentials are contained in the or retrieved via the Type Metadata parameters (as defined in type-metadata-format).  A schema MUST be represented by a JSON Schema document according to draft version 2020-12 JSON.SCHEMA.2020-12 or above. The schema of a Verifiable Credential MUST include all properties that are required by this specification and MUST NOT override their cardinality, JSON data type, or semantic intent. The following is a non-normative example of a JSON Schema document for the example in vc-sd-jwt-example requiring the presence of the claim in an SD-JWT VC presentation: Note that and are always required by this specification. 6.5.2. If a or property is present, a Consumer MUST validate the JSON document resulting from the SD-JWT verification algorithm (as defined in Section 8 of I-D.ietf-oauth-selective-disclosure-jwt) against the JSON Schema document provided by the or property. If an property is present, the schema of the extended type MUST also be validated in the same manner.  This process includes validating all subsequent extended types recursively until a type is encountered that does not contain an property in its Type Metadata.  Each schema in this chain MUST be evaluated for a specific Verifiable Credential. If the schema validation fails for any of the types in the chain, the Consumer MUST reject the Verifiable Credential. The following is a non-normative example of a result JSON document after executing the SD-JWT verification algorithm that is validated against the JSON Schema document in the example provided in schema- definition: Note, the example above does not contain any , , or claims. </ins> 7. Both the <del> claim in the SD-JWT VC and various URIs in the metadata document MAY </del> <ins> claim in the SD-JWT VC and the various URIs in the Type Metadata MAY </ins> be accompanied by a respective claim suffixed with , in particular:

Related discussion:
text: Thank you for this elaboration! It means that in this case, you won't need SD-JWT VC Issuer Metadata well-known, right?
using federation the metadata must be signed and evaluated within the trust chain, therefore, yes, there are no direct dependencies with the SD-JWT VC Issuer Metadata well-known endpoint, even if these two can cohexist within the same entity.
I'm supportive of changing value requirements for the following reasons: using could be a bit misleading using to match against the SAN DNS value is error prone (some devs might forget to do and instead do ) and perhaps misleading if does not exist (although the domain exists). Perhaps an edge case but it might have security implications.
to chage the requirement to be not a URI but a string for cases when is a DNS SAN value? the point of in HAIP was that the issuer can use the same value in sd-jwt vc to support various key resolution mechanisms - web-based key resolution (.well-known/jwtvcissuer with or without openid federation) or x509. so I am supportive of keeping a URI in sd-jwt vc, but change the scheme to as opposed to regarding your points 2 and 3, for example, in HAIP, the idea was for the issuer to support both key resolution mechanisms, so the chance of devs forgetting doing is low, and the verifier supporting x509, would have to extract dns name from as part of validations steps, so I see your points, but still think the the benefits of the same with different key resolution mechanisms is strong.
I support this, see my reasoning here: URL
NAME and I chatted briefly and are leaning towards keeping the requirement on iss to be a URI while using an https scheme for both key resolution mechanisms.
NAME said she might have some suggested text or a PR along those lines
NAME I'm going to work on this tomorrow (hopefully) so if you have anything that might help in that effort, please comment or post it or whatever works.