JWK: document it, and use GOOPS

1 files changed, 135 insertions, 147 deletions

diff --git a/po/disfluid.pot b/po/disfluid.pot
index 022b8db..d9126b9 100644
--- a/po/disfluid.pot
+++ b/po/disfluid.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: disfluid SNAPSHOT\n"
 "Report-Msgid-Bugs-To: vivien@planete-kraus.eu\n"
-"POT-Creation-Date: 2021-09-17 14:10+0200\n"
+"POT-Creation-Date: 2021-09-17 14:13+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -131,12 +131,12 @@ msgstr ""
 msgid "this is not an access token, because it is not even a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/access-token.scm:77 src/scm/webid-oidc/dpop-proof.scm:96
+#: src/scm/webid-oidc/access-token.scm:77 src/scm/webid-oidc/dpop-proof.scm:101
 #, scheme-format
 msgid "this is not an access token: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/access-token.scm:79 src/scm/webid-oidc/dpop-proof.scm:98
+#: src/scm/webid-oidc/access-token.scm:79 src/scm/webid-oidc/dpop-proof.scm:103
 msgid "this is not an access token"
 msgstr ""
 
@@ -295,7 +295,7 @@ msgstr ""
 #: src/scm/webid-oidc/authorization-page-unsafe.scm:52
 #: src/scm/webid-oidc/hello-world.scm:40 src/scm/webid-oidc/hello-world.scm:167
 #: src/scm/webid-oidc/hello-world.scm:187
-#: src/scm/webid-oidc/identity-provider.scm:139
+#: src/scm/webid-oidc/identity-provider.scm:143
 #: src/scm/webid-oidc/token-endpoint.scm:111
 #: src/scm/webid-oidc/token-endpoint.scm:137
 #: src/scm/webid-oidc/token-endpoint.scm:164
@@ -477,78 +477,78 @@ msgstr ""
 msgid "the client manifest is dereferenced from ~s, but it pretends to be ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:289
+#: src/scm/webid-oidc/client/accounts.scm:285
 msgid "The refresh token has expired."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:296
+#: src/scm/webid-oidc/client/accounts.scm:292
 #, scheme-format
 msgid "The token request failed with code ~s (~s)."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:305
+#: src/scm/webid-oidc/client/accounts.scm:301
 msgid "The token response did not set the content type."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:313
+#: src/scm/webid-oidc/client/accounts.scm:309
 msgid "The token endpoint did not respond in UTF-8."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:325
+#: src/scm/webid-oidc/client/accounts.scm:321
 #, scheme-format
 msgid "The token response has content-type ~s, not application/json."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:335
+#: src/scm/webid-oidc/client/accounts.scm:331
 msgid "The token response is not valid JSON."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:349
+#: src/scm/webid-oidc/client/accounts.scm:345
 #, scheme-format
 msgid "The token response did not include an ID token: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:357
+#: src/scm/webid-oidc/client/accounts.scm:353
 #, scheme-format
 msgid "The token response did not include an access token: ~s\n"
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:368
+#: src/scm/webid-oidc/client/accounts.scm:364
 #, scheme-format
 msgid "the ID token signature is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:370
+#: src/scm/webid-oidc/client/accounts.scm:366
 msgid "the ID token signature is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:388
+#: src/scm/webid-oidc/client/accounts.scm:384
 #, scheme-format
 msgid "the ID token delivered by the identity provider for ~s has ~s as webid"
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:398
+#: src/scm/webid-oidc/client/accounts.scm:394
 #, scheme-format
 msgid "The ID token delivered by the identity provider ~s is for issuer ~s."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:413
+#: src/scm/webid-oidc/client/accounts.scm:409
 msgid "The issuer is required."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:418
+#: src/scm/webid-oidc/client/accounts.scm:414
 msgid "The optional subject and required issuer should be strings or URI."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:454
+#: src/scm/webid-oidc/client/accounts.scm:450
 msgid "Cannot check the username and/or password."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:464
+#: src/scm/webid-oidc/client/accounts.scm:460
 msgid "The subject should be a string or URI."
 msgstr ""
 
-#: src/scm/webid-oidc/client/accounts.scm:478
+#: src/scm/webid-oidc/client/accounts.scm:474
 msgid "The issuer should be a string or URI."
 msgstr ""
 
@@ -568,7 +568,7 @@ msgstr ""
 msgid "You already have an account for ~a issued by ~a."
 msgstr ""
 
-#: src/scm/webid-oidc/client/client.scm:106
+#: src/scm/webid-oidc/client/client.scm:108
 msgid ""
 "Client ID and redirect URIs should be URIs, and key pair should be a key "
 "pair.."
@@ -582,213 +582,217 @@ msgstr ""
 msgid "Hello, world!"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:91
+#: src/scm/webid-oidc/dpop-proof.scm:96
 #, scheme-format
 msgid "this is not a DPoP proof, because it is not even a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:93
+#: src/scm/webid-oidc/dpop-proof.scm:98
 msgid "this is not a DPoP proof, because it is not even a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:124
+#: src/scm/webid-oidc/dpop-proof.scm:129
 #, scheme-format
 msgid "the DPoP proof is missing ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:147
+#: src/scm/webid-oidc/dpop-proof.scm:152
 #, scheme-format
 msgid "the \"jti\" field should be a string, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:154
+#: src/scm/webid-oidc/dpop-proof.scm:159
 #, scheme-format
 msgid "the \"htm\" field should be a string, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:161
+#: src/scm/webid-oidc/dpop-proof.scm:166
 #, scheme-format
 msgid "the \"htu\" field should be an URI, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:168
+#: src/scm/webid-oidc/dpop-proof.scm:173
 #, scheme-format
 msgid "the \"iat\" field should be a timestamp, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:175
+#: src/scm/webid-oidc/dpop-proof.scm:180
 #, scheme-format
 msgid "the \"ath\" field should be an encoded JWT, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:184
+#: src/scm/webid-oidc/dpop-proof.scm:189
 #, scheme-format
 msgid "the \"alg\" field should be a string, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:189
+#: src/scm/webid-oidc/dpop-proof.scm:194
 #, scheme-format
 msgid "the \"typ\" field should be \"dpop+jwt\", not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:195
+#: src/scm/webid-oidc/dpop-proof.scm:200
+msgid "the \"jwk\" field should not contain the private key"
+msgstr ""
+
+#: src/scm/webid-oidc/dpop-proof.scm:202
 #, scheme-format
 msgid "the \"jwk\" field should be a valid public key, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:274
+#: src/scm/webid-oidc/dpop-proof.scm:281
 #, scheme-format
 msgid "the DPoP proof is signed for ~s, but it is issued to ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:305
+#: src/scm/webid-oidc/dpop-proof.scm:312
 #, scheme-format
 msgid "the DPoP proof cannot be decoded: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:307
+#: src/scm/webid-oidc/dpop-proof.scm:314
 msgid "the DPoP proof cannot be decoded"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:317
+#: src/scm/webid-oidc/dpop-proof.scm:324
 #, scheme-format
 msgid "the DPoP proof is signed for access through ~s, but it is used with ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:331
+#: src/scm/webid-oidc/dpop-proof.scm:338
 #, scheme-format
 msgid ""
 "the DPoP proof is signed in the future, ~a, relative to the current date, ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:340
+#: src/scm/webid-oidc/dpop-proof.scm:347
 #, scheme-format
 msgid "the DPoP proof is too old, it was signed ~a and now it is ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:352
+#: src/scm/webid-oidc/dpop-proof.scm:359
 #, scheme-format
 msgid ""
 "the DPoP proof should go along with an access token hashed to ~s, not ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:361 src/scm/webid-oidc/dpop-proof.scm:372
+#: src/scm/webid-oidc/dpop-proof.scm:368 src/scm/webid-oidc/dpop-proof.scm:379
 msgid "the DPoP proof is signed with the wrong key"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:370
+#: src/scm/webid-oidc/dpop-proof.scm:377
 #, scheme-format
 msgid "the DPoP proof is signed with the wrong key: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:381
+#: src/scm/webid-oidc/dpop-proof.scm:388
 msgid "the cnf/check function returned #f"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:392
+#: src/scm/webid-oidc/dpop-proof.scm:399
 #, scheme-format
 msgid "cannot encode a DPoP proof: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/dpop-proof.scm:394
+#: src/scm/webid-oidc/dpop-proof.scm:401
 msgid "cannot encode a DPoP proof"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:98
+#: src/scm/webid-oidc/example-app.scm:97
 #, scheme-format
 msgid "~a (issued by ~a): no interaction required"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:101
+#: src/scm/webid-oidc/example-app.scm:100
 #, scheme-format
 msgid "~a (issued by ~a): offline but accessible"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:104
+#: src/scm/webid-oidc/example-app.scm:103
 #, scheme-format
 msgid "~a (issued by ~a): online"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:107
+#: src/scm/webid-oidc/example-app.scm:106
 #, scheme-format
 msgid "~a (issued by ~a): inaccessible"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:120
+#: src/scm/webid-oidc/example-app.scm:119
 #, scheme-format
 msgid "Your choice ~a does not exist.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:138
+#: src/scm/webid-oidc/example-app.scm:137
 msgid "Your choice is not a valid URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:147
+#: src/scm/webid-oidc/example-app.scm:146
 msgid "This is not a valid HTTP method.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:163
+#: src/scm/webid-oidc/example-app.scm:162
 msgid "This is not a valid value for this header.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:201
+#: src/scm/webid-oidc/example-app.scm:200
 msgid "Nothing to undo.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:213
+#: src/scm/webid-oidc/example-app.scm:212
 msgid "Nothing to redo.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:273
+#: src/scm/webid-oidc/example-app.scm:272
 msgid "Example app command|add-account"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:275
+#: src/scm/webid-oidc/example-app.scm:274
 msgid "Example app command|choose-account"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:277
+#: src/scm/webid-oidc/example-app.scm:276
 msgid "Example app command|set-uri"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:279
+#: src/scm/webid-oidc/example-app.scm:278
 msgid "Example app command|set-method"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:281
+#: src/scm/webid-oidc/example-app.scm:280
 msgid "Example app command|view-headers"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:283
+#: src/scm/webid-oidc/example-app.scm:282
 msgid "Example app command|clear-headers"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:285
+#: src/scm/webid-oidc/example-app.scm:284
 msgid "Example app command|add-header"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:287
+#: src/scm/webid-oidc/example-app.scm:286
 msgid "Example app command|ok"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:289
+#: src/scm/webid-oidc/example-app.scm:288
 msgid "Example app command|undo"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:291
+#: src/scm/webid-oidc/example-app.scm:290
 msgid "Example app command|redo"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:301
+#: src/scm/webid-oidc/example-app.scm:300
 #, scheme-format
 msgid "To log in on ~a, please visit: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:304
+#: src/scm/webid-oidc/example-app.scm:303
 msgid "Then, paste the authorization code you get:\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:322
+#: src/scm/webid-oidc/example-app.scm:321
 #, scheme-format
 msgid ""
 "Account: ~a\n"
@@ -808,87 +812,87 @@ msgid ""
 "\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:341
+#: src/scm/webid-oidc/example-app.scm:340
 msgid "Account:|unset"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:345
+#: src/scm/webid-oidc/example-app.scm:344
 msgid "URI:|unset"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:349
+#: src/scm/webid-oidc/example-app.scm:348
 msgid "Method:|unset"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:352
+#: src/scm/webid-oidc/example-app.scm:351
 msgid "Headers:|none"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:356
+#: src/scm/webid-oidc/example-app.scm:355
 msgid "list separator|, "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:366
+#: src/scm/webid-oidc/example-app.scm:365
 #, scheme-format
 msgid "You can undo your last command with \"~a\".\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:368
+#: src/scm/webid-oidc/example-app.scm:367
 #, scheme-format
 msgid "You can re-apply your last undone command with \"~a\".\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:369
+#: src/scm/webid-oidc/example-app.scm:368
 msgid "Readline prompt|Command: "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:376
+#: src/scm/webid-oidc/example-app.scm:375
 #, scheme-format
 msgid "An error happened: ~a.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:388
+#: src/scm/webid-oidc/example-app.scm:387
 msgid "Please enter your identity provider: "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:394
+#: src/scm/webid-oidc/example-app.scm:393
 msgid ""
 "You don’t have other accounts available. Please add one with \"add-account"
 "\".\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:400
+#: src/scm/webid-oidc/example-app.scm:399
 #, scheme-format
 msgid "- ~a: ~a\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:408
+#: src/scm/webid-oidc/example-app.scm:407
 #, scheme-format
 msgid "[1-~a] "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:416
+#: src/scm/webid-oidc/example-app.scm:415
 msgid "Visit this URI: "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:422
+#: src/scm/webid-oidc/example-app.scm:421
 msgid "Use this HTTP method [GET]: "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:438
+#: src/scm/webid-oidc/example-app.scm:437
 msgid "Which header? "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:441
+#: src/scm/webid-oidc/example-app.scm:440
 #, scheme-format
 msgid "Which header value for ~a? "
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:464
+#: src/scm/webid-oidc/example-app.scm:463
 msgid "Please define an account and the URI.\n"
 msgstr ""
 
-#: src/scm/webid-oidc/example-app.scm:471
+#: src/scm/webid-oidc/example-app.scm:470
 msgid "I don’t know that command.\n"
 msgstr ""
 
@@ -1023,11 +1027,11 @@ msgstr ""
 msgid "<p>You can only use the <emph>GET</emph> method on this resource.</p>"
 msgstr ""
 
-#: src/scm/webid-oidc/identity-provider.scm:72
+#: src/scm/webid-oidc/identity-provider.scm:76
 msgid "Warning: generating a new key pair."
 msgstr ""
 
-#: src/scm/webid-oidc/identity-provider.scm:132
+#: src/scm/webid-oidc/identity-provider.scm:136
 msgid "reason-phrase|Not Found"
 msgstr ""
 
@@ -1036,152 +1040,136 @@ msgstr ""
 msgid "a replay has been detected with JTI ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:76
-#, scheme-format
-msgid "the JWK is invalid: ~a"
-msgstr ""
-
-#: src/scm/webid-oidc/jwk.scm:78
-msgid "the JWK is invalid"
-msgstr ""
-
-#: src/scm/webid-oidc/jwk.scm:87
-#, scheme-format
-msgid "unknown key type ~s"
+#: src/scm/webid-oidc/jwk.scm:141
+msgid "the point and scalar are not on the same curve"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:103
+#: src/scm/webid-oidc/jwk.scm:236
 #, scheme-format
-msgid "the public JWK is invalid: ~a"
-msgstr ""
-
-#: src/scm/webid-oidc/jwk.scm:105
-msgid "the public JWK is invalid"
+msgid "the JWK is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:136
-#, scheme-format
-msgid "cannot extract the public part of the key: ~a"
+#: src/scm/webid-oidc/jwk.scm:238
+msgid "the JWK is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:138
-msgid "cannot extract the public part of the key"
+#: src/scm/webid-oidc/jwk.scm:247
+msgid "cannot compute the key type"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:188
-msgid "the JWKS is invalid, because it does not have keys"
+#: src/scm/webid-oidc/jwk.scm:284
+msgid "it is built as an RSA key or key pair, but it is not"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:197
-#, scheme-format
-msgid "the JWKS is invalid: ~a"
+#: src/scm/webid-oidc/jwk.scm:292
+msgid "it is built as an elliptic curve key or key pair, but it is not"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:199
-msgid "the JWKS is invalid"
+#: src/scm/webid-oidc/jwk.scm:365
+msgid "this is neither a RSA key nor an elliptic curve key"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:236
+#: src/scm/webid-oidc/jwk.scm:402
 #, scheme-format
 msgid "cannot fetch a JWKS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:238
+#: src/scm/webid-oidc/jwk.scm:404
 msgid "cannot fetch a JWKS"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:242
+#: src/scm/webid-oidc/jwk.scm:408
 #, scheme-format
 msgid "the request failed with ~s ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:247
+#: src/scm/webid-oidc/jwk.scm:413
 msgid "missing content-type"
 msgstr ""
 
-#: src/scm/webid-oidc/jwk.scm:252
+#: src/scm/webid-oidc/jwk.scm:418
 #, scheme-format
 msgid "invalid content-type: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:72
+#: src/scm/webid-oidc/jws.scm:73
 #, scheme-format
 msgid "the JWS is invalid: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:74
+#: src/scm/webid-oidc/jws.scm:75
 msgid "the JWS is invalid"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:93
+#: src/scm/webid-oidc/jws.scm:94
 msgid "the JWS header does not have an \"alg\" field"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:101
+#: src/scm/webid-oidc/jws.scm:102
 msgid "invalid JSON object as payload"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:110
+#: src/scm/webid-oidc/jws.scm:111
 #, scheme-format
 msgid "invalid signature algorithm: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:114
+#: src/scm/webid-oidc/jws.scm:115
 #, scheme-format
 msgid "invalid \"alg\" value: ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:119
+#: src/scm/webid-oidc/jws.scm:120
 msgid "invalid JSON object as header"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:121
+#: src/scm/webid-oidc/jws.scm:122
 msgid "this is not a pair"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:138
+#: src/scm/webid-oidc/jws.scm:139
 msgid "the encoded JWS is not in 3 parts"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:149
+#: src/scm/webid-oidc/jws.scm:150
 #, scheme-format
 msgid ""
 "the encoded JWS header or payload is not a JSON object encoded in base64: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:151
+#: src/scm/webid-oidc/jws.scm:152
 msgid ""
 "the encoded JWS header or payload is not a JSON object encoded in base64"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:210
+#: src/scm/webid-oidc/jws.scm:211
 msgid "the JWS is not signed by any of the expected set of public keys"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:221
+#: src/scm/webid-oidc/jws.scm:222
 #, scheme-format
 msgid "while verifying the JWS signature: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:223
+#: src/scm/webid-oidc/jws.scm:224
 msgid "an unexpected error happened while verifying a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:240
+#: src/scm/webid-oidc/jws.scm:253
 #, scheme-format
 msgid "cannot decode a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:242
+#: src/scm/webid-oidc/jws.scm:255
 msgid "cannot decode a JWS"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:262
+#: src/scm/webid-oidc/jws.scm:272
 #, scheme-format
 msgid "cannot encode a JWS: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/jws.scm:264
+#: src/scm/webid-oidc/jws.scm:274
 msgid "cannot encode a JWS"
 msgstr ""
 
@@ -1223,25 +1211,25 @@ msgstr ""
 msgid "invalid JSON object"
 msgstr ""
 
-#: src/scm/webid-oidc/oidc-configuration.scm:174
+#: src/scm/webid-oidc/oidc-configuration.scm:178
 #, scheme-format
 msgid "cannot fetch the OIDC configuration: ~a"
 msgstr ""
 
-#: src/scm/webid-oidc/oidc-configuration.scm:176
+#: src/scm/webid-oidc/oidc-configuration.scm:180
 msgid "cannot fetch the OIDC configuration"
 msgstr ""
 
-#: src/scm/webid-oidc/oidc-configuration.scm:184
+#: src/scm/webid-oidc/oidc-configuration.scm:188
 #, scheme-format
 msgid "the server responded with ~s ~s"
 msgstr ""
 
-#: src/scm/webid-oidc/oidc-configuration.scm:189
+#: src/scm/webid-oidc/oidc-configuration.scm:193
 msgid "there is no content-type"
 msgstr ""
 
-#: src/scm/webid-oidc/oidc-configuration.scm:194
+#: src/scm/webid-oidc/oidc-configuration.scm:198
 #, scheme-format
 msgid "unexpected content-type: ~s"
 msgstr ""