Implement mDL (ISO 18013-5) online presentation using OID4VP and mdoc CBOR encoding

Steps

1. Understand the mDL data model: the document is encoded as CBOR, structured as a MobileDocument with a docType (org.iso.18013.5.1.mDL), issuerSigned namespaces containing IssuerSignedItems, and a DeviceAuth section
2. For online presentation via OID4VP, the verifier sends a presentation request with input_descriptor specifying the doctype and requested namespaces/element_identifiers
3. The wallet constructs a DeviceResponse CBOR structure, selecting only the requested data elements and computing a DeviceAuth signature over SessionTranscript binding the response to the request
4. The DeviceAuth uses ECDSA with the device key from the MSO (Mobile Security Object); the MSO is signed by the issuer and contains the device public key and the digests of the issued data elements
5. Verify the response: check the issuer signature on the MSO against a trusted issuer CA, recompute the digest of each disclosed IssuerSignedItem and compare to the MSO digest map, then verify DeviceAuth over the session transcript
6. For the ISO 18013-7 online engagement, the verifier engagement is included in the OID4VP request; bind the session using the protocol-defined SessionTranscript that incorporates both verifier and device engagement data