As already mentioned by @Sephster, now the issuer is mandatory!

@Sephster wouldn't RFC 9068 be the relevant spec here? (Now, anyway... I think it did not exist yet when this conversation started.) That does make iss required.

Originally posted by @tgr in #1137 (comment)