[S2S] Validate the Encryption Key lifecycle model

This issue is tracking validating and describing the encryption key lifecycle model.

Issuer Encryption Key is statically hosted (e.g. .well-known) this can be rotated etc as needed. Do we need to say more about how the Wallet trusts this?

• Signed Metadata solves this problem (on an outer layer)

Wallet Encryption Key(s) are allowed be ephemeral and sent as part of initiating requests, and only need to be stored by the issuer for the duration of the request.

This means that no Issuer -> Wallet initiated request can't be encrypted to the Wallet Client. If the Issuer wishes to send encrypted information to the Wallet Client they must do this with a notification poke and have the Wallet call the appropriate endpoint.

Example where this could be a problem today: Verification Status Notification containing ADDITION_INFO_REQUIRED with a payload with PII.

So would have to do notification -> Get Verification Status (w/ WEK) to retrieve it.

Start by reviewing the Issuer Encryption Key and Wallet Encryption Key lifecycle described in the issue, including the notification and Get Verification Status example. Done means the lifecycle model is validated and described, including how encrypted information and PII are retrieved when the wallet key is ephemeral.