Issue and verify an SD-JWT VC (RFC 9901 / draft-ietf-oauth-sd-jwt-vc) with selective disclosure

Steps

1. Construct the SD-JWT: for each claim to be selectively disclosable, replace the claim value in the JWT payload with a hash of a disclosure object (salt + claim name + value); include the hashes in a _sd array in the JWT payload.
2. Sign the JWT (the Issuer-signed JWT, or I-JWT) with the issuer's key; the typ header should be 'dc+sd-jwt' for VC use cases.
3. Append each disclosure as a base64url-encoded JSON string separated by '~' after the JWT; the final SD-JWT string is: <I-JWT>~<disclosure1>~<disclosure2>~...
4. For presentation, the holder selects which disclosures to include (omitting others achieves selective disclosure), optionally appends a Key Binding JWT (KB-JWT) signed with the holder's key to bind the presentation to the verifier's nonce, and sends the resulting SD-JWT+KB.
5. The verifier: splits on '~', verifies the I-JWT signature, computes SHA-256 of each included disclosure and confirms each hash appears in the _sd arrays, reconstructs the plaintext claims from the disclosed values, and verifies the KB-JWT nonce and audience.