BREAKING: OpenID for Verifiable Credential Issuance Gets a Major Upgrade!

• New Signed Metadata Mechanism: Adds a new way to handle signed Credential Issuer metadata for enhanced security.
• Removal of signed_metadata: The old method for signed metadata is removed to streamline the process.
• Authorization Request Changes: The option to use format from authorization_details in Authorization Requests is removed.
• Deferred Credential Handling: Moves issuance pending and interval parameters to more appropriate sections for clarity.
• DPoP Nonce Support: Adds an option to return DPoP Nonce from the Nonce Endpoint for better security.
• Cryptographic Key Binding: Renames "Cryptographic Holder Binding" to "Cryptographic Key Binding" for consistency.
• Dynamic Credential Request Removal: The Dynamic Credential Request section is removed to simplify the standard.
• Encryption Requirements: Adds support for Credential Request encryption and Zip, and mandates request encryption when response encryption is used.
• Security Clarifications: Improves language around security recommendations, including FAPI2 Security Profile usage.
• Error Handling Updates: Introduces new errors like unknown_credential_configuration and removes outdated ones like unsupported_credential_type.

The **OpenID for Verifiable Credential Issuance (OID4VCI)** standardizes the issuance of **Verifiable Credentials (VCs)**—digitally signed attestations like diplomas or licenses—using OAuth 2.0. It supports multiple formats (W3C VCs, ISO mdoc, SD-JWT VCs) and offers both interactive and pre-authorized issuance flows. The framework ensures security through TLS encryption, replay protection, and data minimization, while enabling extensibility for custom credential types. This update refines metadata handling, security protocols, and error management, aligning with **Self-Sovereign Identity (SSI)** principles for interoperable, user-centric digital identity ecosystems.