references in fapi-2_0-message-signing

Issue #560 resolved
Brian Campbell created an issue

[Security Profile] should be a real reference

and

JARM is final now and at https://openid.net/specs/oauth-v2-jarm.html