Small fix in the GetEnvelopeSignedCSR

Signed-off-by: Fabrizio Damato <fabrizio.damato@amd.com>

Author: fdamato

specifications/device-identity-provisioning/spec.ocp

@@ -266,7 +266,7 @@ The following fields should be treated identically as in GET_CSR from SPDM 1.3:
 
 The following fields present in this command are not present in GET_CSR:
 
-- **SignerSlotIDParam** - defines which key signs the CSR envelope.
+- **SignerSlotIDParam** - defines which key signs the CSR envelope (for SPDM Implementation).
 - **Nonce** - provides freshness.
 
 Table: ENVELOPE_SIGNED_CSR VendorDefinedRespPayload {#tbl:ecsr-resp}
@@ -304,9 +304,7 @@ The EnvelopeSignedCSRdata shall adhere to the following requirements:
   - An array of OIDs representing the key's derivation attributes (see @sec:defined-oids for defined OIDs)
 - The CSR included in the EAT SHALL be DER-encoded and may be either self-signed or non-self-signed depending on device capabilities. For non-self-signed CSRs, the signature field SHALL contain all zeroes and be the same size as would be required for a valid signature using the subject key's algorithm.
 - The nonce claim SHALL match the nonce value provided in the GET_ENVELOPE_SIGNED_CSR request to ensure freshness.
-- If SignerSlotIDParam indicates a signed envelope, the CWT SHALL be signed by an Attestation Key endorsed by the certificate chain corresponding to the specified SlotID. In addition, the unprotected header of the CWT SHALL contain the Attestation Key's certificate chain, including at least all certificates from the Attestation Key up to the identity certificate issued by the slot's PKI owner.
-  - E.g., Slot 0's certificate chain would extend at least to the vendor-endorsed certificate over IDevID. A separate slot's certificate chain would extend at least to the certificate issued by the slot's configured PKI owner.
-  - A device may report intermediate certificates for the slot's PKI owner if it is configured to do so.
+- The CWT SHALL be signed by an Attestation Key. The EAT's protected header contains a key identifier (kid) that indicates which key signed the EAT, allowing verifiers to locate the appropriate certificate for verification.
 
 [^private-claims]: RFC 8392 [@{ietf-cwt}] defines a private claim as one whose key value has an integer value < -65536.
 
@@ -356,6 +354,7 @@ The EAT SHALL be encoded as a signed CWT using COSE_Sign1. The signature provide
 **Key Identification:**
 
 The COSE_Sign1 protected header SHALL include:
+
 - **Algorithm identifier (alg: 1)** - Integer identifying the signature algorithm used
 - **Content type (content-type: 3)** - Text string or integer indicating the content type (for EAT, this is typically "application/eat+cwt")
 - **Key ID (issuer-key-id: 4)** - Binary string that MUST match the subject name of the certificate containing the public key that can verify the EAT signature