Add guidance on how to secure status lists.

[msporny]

This PR is an attempt to address issue #52 by adding guidance on how to secure the status list.

---

Preview | Diff

[David-Chadwick]

It seems reasonable to require the same security mechanism for the status list as for the verifiable credential. But it is not mandated if there is a requirement to not do so.

[TallTed]

[@David-Chadwick] It seems reasonable to require the same security mechanism for the status list as for the verifiable credential. But it is not mandated if there is a requirement to not do so.

I cannot figure out what your second sentence is trying to say.

[iherman]

The issue was discussed in a meeting on 2024-01-10

• no resolutions were taken

View the transcript

3.4. Add guidance on how to secure status lists. (pr vc-bitstring-status-list#118)

See github pull request vc-bitstring-status-list#118.

Manu Sporny: we should not mix and match the security mechanisms on the status list and the vcs that it contains.
… they should all use the same mechanism e.g. JWT or data integrity.

[msporny]

Normative, multiple reviews, no changes requested, no objections, merging.