WIMSE Trust Domain Discovery#

Arndt Schwenkschuster, Yaroslav Rosomakho.

• Why: WIMSE scopes identifiers to a trust domain but leaves how a relying party obtains that domain's trust anchors undefined — the exact gap SPIFFE fills with the Bundle Endpoint. In open environments with no prior relationship, that gap blocks any cross-org WIMSE deployment.
• What: Defines the WIMSE Trust Bundle (JWKS-formatted, with use values distinguishing wimse-jwt and wimse-x509 signing material for both credential types) and a Trust Domain Metadata document at /.well-known/wimse-trust-domain (redirects allowed) that resolves a trust-domain name to its bundle endpoint.
• How: A domain owner serves metadata and bundle publicly over HTTPS, mirroring the OIDC metadata/SPIFFE bundle patterns; private deployments can serve them privately or use .internal TLDs with different distribution.
• Where applicable: Open federation-style workload identity. Individual draft asking "do we agree on the problem space?" — early, but it's the missing interoperability piece for the mature WIMSE credential docs.