Hi,

According to Section 4.1 the beginning of a trust chain is an entity configuration, which is an entity statement where the iss and sub are identical (See Section 3.1).

This is not the case for the first entry of the trust chain in the example of Figure 6 with this decoded payload:

{
"valid": false,
"payload": {
"metadata": {
"openid_credential_issuer": { ... },
"federation_entity": { ... }
},
"authority_hints": [
"https://intermediate.eidas.example.org"
],
"jwks": { ... },
"sub": "https://credential_issuer.example.org",
"iss": "https://intermediate.eidas.example.org",
"iat": 1758527818,
"exp": 1758827818
},
"header": { ... }
}