Explicitly state what is being signed in an identity assertion

[paulengland]

• I have read the CLA Document and I hereby sign the CLA.

---

Presumably something like "The signature is formed over the canonical CBOR serialization of the referenced_assertions field"

Also: Should we call the envelope "identity-map" for uniformity?

[paulengland]

A more future-proof method might be to define an identity-assertions-tbs (to be signed) map that contains referenced_assertions so that it's less disruptive if we ever want to add new data to the stuff signed by an identity signer. See, for example, #65

[scouten-adobe]

Related to #68

[scouten-adobe]

I believe this was addressed by #75. Closing as completed.