Metadata publication requirements

[martijnharing]

Section 4.1 states that:

The Credential Issuer MUST support metadata retrieval according to Section 12.2.2 of [OIDF.OID4VCI]. The Credential Issuer metadata MUST include a scope for every Credential Configuration it supports.

Does this effectively mean that implementing HAIP requires issuers to have public information on all credential types and configurations it supports? Or is there a way to comply with HAIP while making that information only available to authorized entities.

[jogu]

I believe the intention was still to allow people to not publish some credential configurations. Could perhaps reword this as:

The Credential Issuer MUST support metadata retrieval according to Section 12.2.2 of [OIDF.OID4VCI]. The Credential Issuer metadata MUST include a scope for every Credential Configuration.

(i.e. dropping the 'it supports' from the end)

[martijnharing]

I don't really understand what difference that makes. Can you give a specific example of a case where there is a difference in what the issuer is required to do between "it supports" being present or not in the requirement?