DCQL: trusted authority restriction

Scenario

A verifier requests a University Degree credential, accepting it only if issued by an authority on a named ETSI trust list. The issuer must sign with an X.509 certificate chain (x5c): a credential without one, or from an issuer outside the list, does not satisfy the query.

Prerequisites

• An iGrant.io Organisation Wallet Suite (OWS) API key. Get it from support@igrant.io. Keep it on the server, in an environment variable or a secret manager. The browser never sees it.
• The OWS environment the key belongs to. The default is demo (https://demo-api.igrant.io). Use staging (https://staging-api.igrant.io) only when the integrator asks for it. A key works only in its own environment.