Thank you for this very nice article, very interesting and mind opening.
After reading the following:
For the access token, on the other hand, there is a set of techniques, collectively known as sender constraint, that allow you to bind an access token to a specific sender.
I was thinking, can I not use the ID token with the sender constraint techniques such as DPoP? What is preventing me to use the ID token instead of the access token togheter with DPoP?
Bear with me guys, if this a stupid question with a simple answer I cannot see…
Regards,
Luca