RE: OCSP response pre-production

["Michael Myers" <mmyers@xxxxxxxxx>]

If we don't define a nonce-specific error, it's predictable that
client developers will choose one of the existing 5 unsigned
error values in order to pop up a dialog that says, essentially,
"You used a nonce and received an error.  If you want to try
again not using nonces, click here."

It doesn't matter much which error; any one will do in order to
discover if nonce use is the problem.  In fact if nothing
changed I'm wondering what the server side *would* send back?
I've recently seen suggestions on this list for
malFormedRequest, internalError and unauthorized.

Not defining a nonce-specific error value escapes nothing.
Clients can today enable relying parties to achieve their
intended goals via error-triggered nonce capability discovery.

Mike