Document key discovery for OIDC

[OR13]

@Sakurann mentioned we should reference more, and repeat or "redefine" less.... I agree.

We can possibly refer to this:

• https://openid.net/specs/openid-connect-userinfo-vc-1_0.html#name-userinfo-vc-verification

[johnandersen777]

How do we see OIDC working with SCITT other than for auth? I'm having trouble understanding how we could use a token as the issuer of a claim. It seems like that would immediately leak the token upon insertion to the log.

Edit:

$ scitt-emulator client create-claim --issuer did:web:token.actions.githubusercontent.com --content-type application/json --payload '{"sun": "yellow"}' --out claim.cose

[SteveLasker]

Moved to ietf-scitt/draft-birkholz-scitt-scrapi#6 in SCRAPI