Clarify scope of Resolve Issuer

[JAG-UK]

The intent statement currently says:

This endpoint is used to discover verification keys, which is the reason that authentication is not required.

In use cases where this endpoint is useful, it's often the case that you want more metadata/supporting evidence than purely keys.

A suggestion from the field: return supporting evidence enabling the client to verify the issuer signature at the time of registration

[JAG-UK]

Additionally there's a naïve notion that this information should be returned with no auth.
This is great from a global verifiability point of view but it needs a balancing statement that allows/encourages auth for things that might contain PII, for example.

[achamayou]

+1 for removing the authentication restriction, while some transparency services like CT are scoped to the internet at large, others may be scoped to a group or an organisation.

In use cases where this endpoint is useful, it's often the case that you want more metadata/supporting evidence than purely keys.

Can you elaborate on this? Although I see the case for additional key-related metadata (e.g. validity ranges in the ledger, cross-endorsement), I am curious about other metadata and to what extent it's worth bundling together/splitting.