Support returning nonce in any responses, similar to DPoP

[TimoGlastra]

DPoP allows returning the DPoP nonce in any response using the DPoP-Nonce header.

Would it be possible to also enable support for this in this specification.

For integration with OID4VCI we now have three nonces:

• DPoP nonce
• Client Attestation Nonce
• Credential request/proof nonce

It would be great if we can bundle these in one request to the nonce endpoint. For DPoP I see no problems, but it seems incompatible with the method described in this specification

[paulbastian]

Editors Call

• agree that this is useful
• solution could be to state that attestation-nonce headers could be returned in any previous responses (e.g. other endpoints)
• be aware that the text on DPoP standard is not as clear as you may think, see also Add DPoP Nonce to Nonce Endpoint openid/OpenID4VCI#478

[TimoGlastra]

Section 8.2 of DPoP spec reads to me that you can include a DPoP nonce in any response

https://datatracker.ietf.org/doc/html/rfc9449#name-providing-a-new-nonce-value

(Ah i see the PR now, I interpreted it the same as @jogu, but I also don't see a lot of ambiguity in the text, it seems pretty clear to me)