User agents that only support authorized verifiers (for government credentials)

[johannhof]

With verifier authorization generally being optional in frameworks such as the EUDI ARF, it seems that some user agents would find it desirable to restrict their support for government credentials to verifiers that have undergone some registration and certification process with the issuer / the government.

@marcoscaceres's comment in #262 (comment) makes it sound like that is the requirement WebKit ships today. Marcos, can you comment more on this?

I believe that @martinthomson mentioned to me that such a limitation could also be desirable for Mozilla

Even if a user agent does not want to outright block requests from unauthorized verifiers, it might be desirable to increase user friction and show some kind of warning.

Assuming that there are > 0 implementers that desire this, is this something that should be defined more formally in the DC API spec?

[johannhof]

I should say that there are some big technical and non-technical challenges that would have to be figured out first - if a request is signed, how does the browser verify that signature? Is this a system that will establish itself in practice, and does it scale globally? There's probably more.

[RByers]

I agree. At one point I had talked with some OpenID4VP folks about having a 'bit' in the request that says the wallet must reject unless the verifier had been explicitly authenticated. That never happened, but maybe it is possible to do at the DC API and platform layers instead?

@leecam any thoughts for Android?