mdoc & SD-JWT VC 'must' requirements for status list are very different

https://openid.github.io/OpenID4VC-HAIP/openid4vc-high-assurance-interoperability-profile-1_1-wg-draft.html#name-ietf-sd-jwt-vc-profile has a bunch of requirements for status list, e.g.:

The public key used to validate the signature on the Status List Token defined in [I-D.ietf-oauth-status-list] MUST be included in the x5c JOSE header of the Token

Each Credential MUST have its own unique, unpredictable status list index

These requirements only apply to SD-JWT - for mdoc we just say:

The Credential Issuer MAY include the MSO revocation mechanism in the issued mdoc. When doing so, it MUST use one of the mechanisms defined in ISO/IEC 18013-5 ([ISO.18013-5.second.edition]).

which doesn't say anything on either of the two above topics. For 'Each Credential MUST have its own unique, unpredictable status list index' - whereas the base token list IETF draft has that as a 'SHOULD'.

This ends up with a weird asymmetry that is probably unexpected - when testing issuers, an SD-JWT VC issuer that reuses status list indexes will fail and can't be certified, but a mdoc issue that reuses status list indexes just gets a 'warning' and can be certified.

I'm not really sure what to do about that. We may just have to leave it as a weird oddity, unless ISO tighten up the text in -5 2nd edition (I've suggested they look into it).

Start with the linked OpenID4VC-HAIP section on the SD-JWT VC profile and compare its status-list requirements with the mdoc wording and the referenced status-list draft. Check the cited ISO/IEC 18013-5 second-edition material for the corresponding mdoc requirements. Done means reaching and documenting a decision on whether the profile text should be aligned or intentionally remain asymmetric.