Consider removing ES256K (secp256k1) support

Summary

Consider dropping ES256K (secp256k1) support, which is gated behind the jwx_es256k build tag. It appears unused, is not built into the default binary, and carries maintenance cost.

Why

• Opt-in only, likely unused. ES256K is only compiled when building with -tags jwx_es256k (see Makefile build target and crypto/jwx/jwx_es256k.go). The default binary does not include it. No known deployment enables it.
• Untested / rotted. CI only builds with the tag, it never runs tests with it, so crypto/jwx/jwx_es256k_test.go has silently rotted:
  • it lives in package jwx but calls ParseJWT, which is in package crypto (would be an import cycle),
  • it passes the wrong number of arguments to ParseJWT,
  • it signs with a P-256 key (test.GenerateECKey()) for a secp256k1 algorithm.
    The test file has therefore not compiled for a long time and nobody noticed.
• Maintenance cost. It's an extra code path that the jwx v2→v3 migration (#4383 / PR #4391) had to fix separately precisely because it's excluded from the normal build/test, so it's easy to miss.

Options

1. Remove ES256K support entirely: delete crypto/jwx/jwx_es256k.go + _test.go, drop the jwx_es256k build tag from the Makefile, and remove the es256k/secp256k1 branches in vdr/didkey/resolver.go and the related test cases in vcr/credential, vcr/pe, vdr/didkey.
2. Keep it but make it real: run the tagged tests in CI and fix the rotted test, so it can't silently break again.

Recommendation

Remove it (option 1) unless someone identifies an active consumer. secp256k1 is niche for did:web/IAM (our active focus), and an untested, build-tag-gated code path is a liability.

Context

Surfaced during the jwx v2→v3 migration (PR #4391): the jwa.ES256K constant→function change was missed initially because the file is excluded from the default build. The build is now fixed; the tagged test remains broken and was left as-is pending this decision.

Assisted by AI

Start by checking crypto/jwx/jwx_es256k.go and crypto/jwx/jwx_es256k_test.go, then inspect the Makefile build target and the ES256K-related branches and tests in vdr/didkey/resolver.go, vcr/credential, and vcr/pe. Confirm whether any active consumer requires the tagged path; done means either removing the path and its build-tag references with the relevant tests updated, or making tagged CI tests compile and run.