The W3C DID document for Baselayer's credential issuer. Every credential names its issuer as a did:web identifier; verifiers resolve that identifier to this document and match the credential's signing key id against verificationMethod. Keys publish ahead of activation and remain published through rotation overlap, so verifier caches stay warm. Unauthenticated; cacheable for one hour.