[proposal] Filter `VerificationMethod` by `kid` if one is present in the header

The default behavior for JWT/JWS verification is to extract an array of possible signers from the DID document of the iss and then verify each signer to check for a signature match.

This can be improved by also looking for a kid property in the header and only using that one for verification.

For this to work, kid (if present) must be a DID URL with a #fragment, that dereferences to a VerificationMethod from the DID document of the iss.

• if kid is present, kid and iss DID must match
• if kid is present, apply the filter as early as possible, to avoid expensive cryptographic operations.

[oed]

Bad stalebot!

[OR13]

it’s worth constraining kid to be a DID URL, not a DID… this would mean it is distinguishable from didDocument.id and verificationMethod.controller, both of which would align with iss.