Multi-usage type key ok?

[Nat Sakimura]

There was a question posted in OAUTH-WG regarding PAR on May 12.

Also, I have a question about using JWT for initial request registration, I'm enforcing default asymmetric authentication (private_key_jwt, and mTLS (not implemented yet) with restricted encryption algorithms, if I use the private key of the client to sign the JWT request registration, and use client_assertion, it sounds for me like using the same key for multiple purposes.

Do we want to give some guidance on it?

[Michael Jones]

On the 4-Jun-20 call, we didn’t see an actual problem with this key usage. In both cases, it’s the client signing the requests for the same purpose.

[Michael Jones]

Closing on 20-Jul-20 per decision on the working group call