TTS Configuration

[PieterKas]

WGLC. Feedback from Dan Moore

At https://www.ietf.org/archive/id/draft-ietf-oauth-transaction-tokens-06.html#section-9.8-2
says workloads should authenticate to a config service, but https://www.ietf.org/archive/id/draft-ietf-oauth-transaction-tokens-06.html#section-7.6-1 says client MUST perform mutual authetication with the TTS. Why not require it for the configuration that leads the workload to the TTS?

[PieterKas]

The security considerations is focused on protecting the client from downloading or obtaining configuration data that may have been manipulated by an attacker to point the client to an untrustworthy transaction token service. It is also conceivable that configuration discovery points may need to be accessible by unauthenticated clients (e.g. if it is co-located with metadata discovery for client, resource or authorisation server metadata). It is also unclear what attacks would be mitigated by enforcing client authentication for configuration discovery. Hence I am inclined to leave the text as is, as it is unclear what the benefit would be and there may be downsides that impact deployments.

@tulshi @gffletch - thoughts?