DpopVerifier class final

Checks DPoP proofs: signature with the header jwk (ES256), typ, htm, htu, ath, iat, nonce and jti reuse; the key must be the one the token is bound to.

Nonces are opaque counters of this fake instead of the HMAC windows of 08 7.3; the current and the previous nonce are accepted, and rotateNonce makes a new one, so a test can make a nonce stale. EdDSA proofs are rejected (the fake checks ES256 only, README).

Example:

final verifier = DpopVerifier(now: () => DateTime.now().toUtc());
final result = verifier.verify(
  proof,
  method: 'GET',
  htu: 'http://127.0.0.1:4711/api/v1/me',
  accessToken: token,
  expectedJkt: session.jkt,
);