Code change:
claim. <del> 6.4.4. </del> <ins> 6.3.4. </ins> <del> A Consumer MAY cache Type metadata for a type.  If a hash for integrity protection is present in the Type Metadata as defined in document-integrity, the Consumer MAY assume that the Type Metadata is static and can be cached indefinitely.  Otherwise, the Consumer MUST use the </del> <ins> A Consumer MAY cache Type Metadata for a SD-JWT VC type.  If a hash for integrity protection is present in the Type Metadata as defined in document-integrity, the Consumer MAY assume that the Type Metadata is static and can be cached indefinitely.  Otherwise, the Consumer MUST use the </ins> header of the HTTP response to determine how long the metadata can be cached. <del> 6.4.5. </del> <ins> 6.3.5. </ins> Credentials MAY encode Type Metadata directly, providing it as "glue <del> information" to the consumer. </del> <ins> information" to the Consumer. </ins> For JSON-serialized JWS-based credentials, such Type Metadata documents MAY be included in the unprotected header of the JWS.  In

Related discussion:
text: (we can discuss whether URI scheme is a good solution in general but this is a separate topic and whether we should not limit to be a URI)
NAME at least for using kid with openid federation is resonable, because that kid is resolved within a federation trust chain
I think there is nothing wrong with: using an HTTPS URI for the value hosting a well-known for that URI including a header with a URI SAN entry that matches the iss value adding to the header In that case, using the to indicate whether well-known is supported or not would not work because like NAME mentioned, apparently OpenID federation uses as well and I believe in that case, well-known is not required. Please correct me if I'm wrong. NAME Can you explain how OpenID federation resolves the ?
To be clear, the above is valid. To be clear, the above just means that using to control how the verifier has to resolve the key does not work because people using OpenID federation might not host a well-known endpoint but will also need a .
NAME sure, thank you for asking imagine the federation trust chain like an object, related to a subject (giuseppe, a trustable entity) linked to a trust anchor (a trusted party over all the others), wwhere in the middle we may have zero, one or more intermediaries between the subject (leaf) and trust anchor. the leaf's metadata can be overloaded by the statements within the chain, along the trust anchor. Therefore the jwks the leafs claims to use, and any other protocol specific metadata, can be dynamically overloaded within the trust chain, by applying the metadata policies. once the policies are applied, the resulting metadata is called final metadata and contains all the jwks related to an entity, for each protocol (since a federation entity configuration may have more than a single metadata creafted for a speicifc role, such as VCI, RP, OP and so on). using the final metadata, the kid is needed in the form of lookup parameter within the JWKs provided within the final metadata
the resolution of the kid is interesting we may have a discovery, using well known endpoints we may have a static trust chain, provided like a x.509 certificate chain
NAME To be even more clear, they might not host a SD-JWT VC Issuer Metadata well-known endpoint but they might host an OpenID Federation well-known endpoint.