Discovery of public key / certificates of Verifier by Wallet

For trust frameworks/jurisdictions in which Verifiers are out of scope for trust/compliance/certification, the Wallet needs a mechanism to discover the Verifier's public key / certificate when receiving a presentation request from the Verifier.

Possible option is a well-known JWKS document which can be retrieved using the FQDN of the Verifier's redirect_uri/response_uri.

e.g.
For a response_uri of https://verifier.example.com/openid4vp/response

• FQDN: verifier.example.com
• well-known document: https://verifier.example.com/.well-known/openid-vp-trust

{
  "keys": [....],
  "trust_anchors": [
    "MIICLzCCAeGgA....YiJC1q2As="
  ]
}

• trust_anchors is list of base64-encoded DER root/CA certificates
• Certificates would be required
• Leaf certificate would require a SAN DNS to match FQDN
• Can be used with x509_hash which allows for compatibility with HAIP

Start with the response_uri/FQDN example and the proposed .well-known/openid-vp-trust document. Review how JWKS, trust_anchors, certificates, SAN DNS matching, and x509_hash are expected to interact. Done means the repository has a decided, implementable discovery mechanism and documented requirements.