Sender-constrained binding established by a transport-layer mechanism.
Core owns only the cross-cutting shape (discriminator + cnf claim);
mechanism packages extend with their own evidence fields. See Wave 2
Token-binding Cluster spec §4.2.
Extension boundary: downstream MAY add a new kind and evidence
fields by extending this interface; the confirmation claim itself
MUST be one of the variants in Confirmation (RFC 7800 / IANA
registry domain). Adding a new confirmation variant (e.g. RFC 9421
jwk confirmation) is a core semver-minor change, not a
downstream-only extension.
Sender-constrained binding established by a transport-layer mechanism. Core owns only the cross-cutting shape (discriminator +
cnfclaim); mechanism packages extend with their own evidence fields. See Wave 2 Token-binding Cluster spec §4.2.Extension boundary: downstream MAY add a new
kindand evidence fields by extending this interface; theconfirmationclaim itself MUST be one of the variants inConfirmation(RFC 7800 / IANA registry domain). Adding a new confirmation variant (e.g. RFC 9421jwkconfirmation) is a core semver-minor change, not a downstream-only extension.