[reinkrul]

Part of the Read the Docs → wiki move (stacked on #4679).

deployment/certificates.rst, did:x509 section, after review:

• keeps the explanation of what did:x509 is and how it differs from connection certificates
• adds how the node validates a did:x509 DID: chain from the credential's x5c header, validated using only that chain; the DID's CA fingerprint must match a CA in the chain; the other DID fields (san, subject) must match the leaf; the TLS trust store and OS CA bundle are not used
• the trust sentence now says how use cases set it: presentation definitions only accept did:x509 DIDs with a specific CA fingerprint
• links the wiki pages on how use cases use certificates (UZI certificates as a source of identity, X509Credential with UZI server certificates)

The CRL, pki.* and algorithm text is unchanged.

Assisted by AI