Lack of clarity on Authority around Unsigned CoRIM Map

[yogeshbdeshpande]

Current specification (06) has no clear way of determining the authority around unsigned corim map

[nedmsmith]

Current specification (06) has no clear way of determining the authority around unsigned corim map

The idea behind unsigned-corim-map is that a conveyance protocol or some outer wrapper layer (e.g., CWT) supplies the signature. The verifier will know what context supplied the signature. It may not be something the CoRIM spec can anticipate.

[yogeshbdeshpande]

There should be a clarifying text in the CoRIM which should state, that authority is out of band for the case of unsigned-corim-map, simply to make the document look more complete!