Misc fix-ups.

- Make OIDs plural throughout.
- Update the diagram to refer to EAT.
- Correct the EAT reference ID in bibliography.yaml.
- Minor shuffling of references.

Author: bluegate010

specifications/device-identity-provisioning/bibliography.yaml

@@ -32,7 +32,7 @@ references:
       month: 5
     url: "https://datatracker.ietf.org/doc/html/rfc8392"
   - id: ietf-eat
-    title: "RATS Entity Attestation Token"
+    title: "Entity Attestation Token"
     publisher: "IETF"
     issued:
       year: 2025

specifications/device-identity-provisioning/diagrams/envelope_signed_csr.drawio.svg

@@ -180,15 +180,15 @@ TODO: fill in
 
 To allow a remote party to establish trust in a selected keypair, the device can emit a Certification Signing Request (CSR) [@{pkcs-10}]. This is supported in SPDM 1.3 [@{spdm-1.3}] via the GET_CSR command. However, there is a drawback to GET_CSR as it is currently defined: the CSR is signed only by the subject key, and does not include a way to attest that the CSR was emitted from a given device.
 
-To allow a device to attest that a given key is trustworthy, the device should issue its own signature over the public key, which can include a freshness nonce and additional metadata, such as the key's derivation attribute OID.
+To allow a device to attest that a given key is trustworthy, the device should issue its own signature over the public key, which can include a freshness nonce and additional metadata, such as the key's derivation attribute OIDs.
 
 ![Envelope-signed CSR](./diagrams/envelope_signed_csr.drawio.svg){#fig:envelope-signed-csr}
 
-The CSR is included as a claim of a CBOR Web Token [@{ietf-cwt}].
+The CSR is included as a claim in an Entity Attestation Token (EAT) [@{ietf-eat}].
 
-Metadata such as the key's derivation attribute OID can also be embedded in a CoRIM. The mechanism for this is out of scope of this specification.
+Metadata such as the key's derivation attribute OIDs can also be embedded in a CoRIM. The mechanism for this is out of scope of this specification.
 
-Some devices may not support the generation of self-signed CSRs for certain keys in their identity key hierarchy, such as LDevID. To support such devices, this specification defines a "non-self-signed CSR", which includes the subject public key but an all-zeroes signature field. The non-self-signed CSR is still itself signed, by way of the Conceptual Message Wrapper.
+Some devices may not support the generation of self-signed CSRs for certain keys in their identity key hierarchy, such as LDevID. To support such devices, this specification defines a "non-self-signed CSR", which includes the subject public key but an all-zeroes signature field. The non-self-signed CSR is still itself signed, by way of the EAT.
 
 ![Envelope-signed Non-self-signed CSR](./diagrams/envelope_signed_csr_non_self_signed.drawio.svg){#fig:envelope-signed-csr-non-self-signed}
 
@@ -298,7 +298,7 @@ Table: ENVELOPE_SIGNED_CSR VendorDefinedRespPayload {#tbl:ecsr-resp}
 
 The EnvelopeSignedCSRdata shall adhere to the following requirements:
 
-- The payload SHALL be an Entity Attestation Token (EAT) [@{ietf-rats-eat}] encoded as a CBOR Web Token (CWT) [@{ietf-cwt}].
+- The payload SHALL be an EAT encoded as a CBOR Web Token (CWT) [@{ietf-cwt}].
 - The EAT SHALL conform to the OCP Envelope-Signed CSR EAT profile (TODO: OCP to assign OID for this profile).
 - The EAT SHALL include standard claims for issuer identification and nonce for freshness verification.
 - The EAT SHALL include private claims[^private-claims] containing:
@@ -310,7 +310,7 @@ The EnvelopeSignedCSRdata shall adhere to the following requirements:
   - E.g., Slot 0's certificate chain would extend at least to the vendor-endorsed certificate over IDevID. A separate slot's certificate chain would extend at least to the certificate issued by the slot's configured PKI owner.
   - A device may report intermediate certificates for the slot's PKI owner if it is configured to do so.
 
-[^private-claims]: RFC 8392 defines a private claim as one whose key value has an integer value < -65536.
+[^private-claims]: RFC 8392 [@{ietf-cwt}] defines a private claim as one whose key value has an integer value < -65536.
 
 ### Key Derivation Attribute OIDs {#sec:key-derivation-attribute-oids}