Add guidance for credential+ld+json for externalproof

[OR13]

Remove proposed guidance that lacked consensus per @dlongley on: #1014

---

Preview | Diff

[mprorock]

added some suggestions to make it very clear what can and can't be done to make things very simple and hopefully avoid 1) confusion, 2) resulting type confusion issues (i.e. like what we keep seeing in x509 and related openssl CVEs)

[dlongley]

added some suggestions to make it very clear what can and can't be done to make things very simple and hopefully avoid 1) confusion, 2) resulting type confusion issues (i.e. like what we keep seeing in x509 and related openssl CVEs)

Of course, adding restrictions do define what can and can't be done. However, the specific restrictions added should have a clear rationale and be technologically defensible.

So, the specific suggestion that you cannot use this media type with a verifiable credential that has an embedded proof ... serves what purpose? Where is that useful and what are the pros / cons?

EDIT: Perhaps it's best to keep this thread of the conversation in #1014.

[mprorock]

added some suggestions to make it very clear what can and can't be done to make things very simple and hopefully avoid 1) confusion, 2) resulting type confusion issues (i.e. like what we keep seeing in x509 and related openssl CVEs)

Of course, adding restrictions do define what can and can't be done. However, the specific restrictions added should have a clear rationale and be technologically defensible.

So, the specific suggestion that you cannot use this media type with a verifiable credential that has an embedded proof ... serves what purpose? Where is that useful and what are the pros / cons?

converting to approve - did not mean to take discussion out of #1014

[msporny]

LGTM. Don't know about @mprorock's addition... on the fence about that one (but wouldn't object if it was merged w/ the corrections).

[iherman]

This PR seems to be unfinished. It refers to the term of "external proof", but it does not define what this means. Until that is properly defined, this is incomplete and should not be merged imho.

[OR13]

@iherman external proof is defined here:

https://w3c.github.io/vc-data-model/#proofs-signatures

However I agree that proof is in general not defined sufficiently in the core data model.

Which is why people can't understand its relationship to credential vs verifiable credential.

[iherman]

@iherman external proof is defined here:

https://w3c.github.io/vc-data-model/#proofs-signatures

I stand corrected. But #1033 (comment) explains why I went wrong: in the new section the term "external proof" appeared as a definition and not as a reference.

[OR13]

@iherman accepted your change suggestion, can you please re-review

[msporny]

Editorial, multiple reviews, changes requested and made, no objections, merging.