no OID wrapping on metadata tokens
make cred anchors subordinate to PrivateAttributes