False JWT VC keyId using did:web

[antebrl]

Describe the bug

A clear and concise description of what the bug is.

The actual keyId of the used key of the DID document is missing in the JWT header attribute 'kid' of a VC.

To Reproduce

You can easily see this behavior in the portal.

1. Issue a credential of any type with did:web
2. Use a oid4vc compliant wallet that can show you the full JWT VC issued.

Expected behavior

The JWT header attribute kid should be in this format:
kid := iss # key-id
This is specified by W3C, because a DID document could contain several keys.

Actual behavior

The header of the JWT looks like this:

{
  "kid": "did:web:wallet.walt.id:wallet-api:registry:portal",
  "typ": "JWT",
  "alg": "ES256K"
}

The kid only contains the did without the keyId.

Additional context

I want to use the issued JWT in other W3C compliant environments (EDC). But they check for the condition kid := iss # key-id and therefore can't validate the JWT.

[alegomes]

Hi @antebrl

Thanks for your report. It has already been included in our backlog and will eventually be prioritised.

Happy holidays,
Ale