Update trust_anchor validation rules

Author: selfissued

openid-federation-1_0.xml

@@ -930,11 +930,14 @@
 	      </t>
 	      <t>
 		If the <spanx style="verb">trust_anchor</spanx> Claim is present,
-		validate that its value is an Entity Identifier.
-		Implementations MAY retrieve the Entity Configuration for the
-		Entity Identifier and validate that it is a Trust Anchor,
-		and they MAY also validate that it is the Trust Anchor
-		used for the Explicit Registration.
+		validate that its value is a URL
+		using the <spanx style="verb">https</spanx> scheme.
+		Implementations MAY validate that the Entity Identifier matches
+		one of the Trust Anchors configured for the deployment.
+		Furthermore, implementations MAY validate that the
+		Entity Configuration for the Entity Identifier contains
+		information compatible with the configured Trust Anchor information
+		- especially the keys.
 		This Claim MUST NOT be present in Entity Statements that are not
 		Explicit Registration responses.
 	      </t>