Array of additional tokens

[PieterKas]

Commenting as identity enthusiast as opposed to WIMSE co-chair.

The oth claim allows for a certain degree of extensibility, but raises a question about what to do if there is more than one additional token for which a hash should be included. should this be an array of hashes? How would an implementor know which of the tokens is corresponding to which of the hashes?

[bc-pi]

The oth claim as it's defined in -00 is kinda garbage, if we're being honest.

Something more along the lines of what @yaronf suggested in #19 (comment) that resulted in #25 would probably be a better approach (to the extent we need this kind of extensibility anyway). While still aiming to avoid reinventing HTTP signatures...

[yaronf]

Decided to avoid, mainly due to complexity. See also #25.