Make clear that requests and responses to resource servers don't have to be bound

[Dave Tonge]

i.e. it is possible to have a signed request, but not a signed response

and its also possible to have a signed response without a signed request

[Tim Würtele]

What is the status on this? The current draft still mandates the RS to cryptographically link the response to the request (Sec. 5.6.2.1 No. 2). Is the plan to basically change the shall in that clause to a may?

[Dave Tonge]

make it clear to only sign request signature and request signature input if applicable (i.e. if present)
also add to the note to explain further

[Dave Tonge]

https://bitbucket.org/openid/fapi/pull-requests/433

[Dave Tonge]

PR merged