Should ephemeral keys be allowed for signing EAT's? about eat

[SimonFrost-Arm]

Given the growing range of use cases for EAT, the alternative to manufacturer provisioned keys may not just be ephemeral keys, but could be keys obtained via an enrollment operation into some service and securely stored e.g. for anonymization reasons or to reflect a set of claims relevant to some service interaction. Agree that the simplest solution here may be to just drop this sentence but consider also whether the rest of the para, starting "In all operating models, the manufacturer provisions some secret attestation key material..." needs revising. I like the idea of a separate security section which could discuss the trust alternatives for the signing key.

[nedmsmith]

A stronger definition of what is meant by 'ephemeral' may be required. This relates to Issue 24.

[laurencelundblade]

Pretty sure the resolution here is to remove most of the operational and architectural model text so EAT is just claims definitions like CWT and JWT.

Discussion of key material can go in other documents or profiles.

[SimonFrost-Arm]

That would be an ideal resolution

[laurencelundblade]

This can be closed because this will go into the architecture document and profiles.

[laurencelundblade]

Fixed in #129