@techreport{schwenkschuster-wimse-trust-domain-discovery-00,
    number =    {draft-schwenkschuster-wimse-trust-domain-discovery-00},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-schwenkschuster-wimse-trust-domain-discovery/00/},
    author =    {Arndt Schwenkschuster and Yaroslav Rosomakho},
    title =     {{WIMSE Trust Domain Discovery}},
    pagetotal = 14,
    year =      2026,
    month =     jul,
    day =       3,
    abstract =  {The WIMSE architecture scopes workload identifiers to a trust domain. To validate a workload identity credential, a relying party must securely obtain the cryptographic trust anchors associated with the credential's trust domain. The WIMSE architecture requires that this mapping between a trust domain and its trust anchors is obtained through a secure mechanism, but leaves that mechanism undefined. This document defines such a mechanism for open environments in which no prior trust relationship exists between the relying party and the trust domain. It specifies the WIMSE Trust Bundle, a document that conveys the trust anchors of a trust domain for both JWT-based and X.509-based workload identity credentials, and a discovery mechanism based on a well-known HTTPS endpoint that allows a relying party to resolve a trust domain name to its trust bundle on demand.},
}