Sort out JWT VC/VP signing

signing key derivation
JWTs should have a kid header, but apparently this is out of scope for the VC data model spec. The Verifier.Validate, Verifier.VerifyVP, and resolver.go#PresentationSigner apply different approaches to deriving the kid that signed a document.

#2683 already makes an attempt at isolating signature verification. This should be extended to include consistent signing key identification for verification for JWT VC/VP

validAt
signature verification currently uses a validAt timestamp that is used to check if the JWT is valid at the given time. This should not be part of a signature check. (should move up to the Verifier.Verify(VP) methods) The only relevant timestamp is that when the JWT is signed, which should be in the nbf/iat field (default to time.Now if missing). This timestamp should be used to check that the signing key was valid at the time of signing.

The same logic should be applied (if not already) to jsonld proof signature verification. So imo signature verification methods do not need a validAt parameter since the relevant timestamps are in the data being verified.

Start with Verifier.Validate, Verifier.VerifyVP, Verifier.Verify(VP), resolver.go#PresentationSigner, and the signature-verification work in #2683. Compare how each derives the signing key identifier and handles validAt, then trace the corresponding JSON-LD proof verification. Done means signing-key identification and timestamp handling are consistent across JWT VC/VP and JSON-LD verification.