[jfroma]

Just to add to your excellent description, one can draw an analogy between the id_token and a VC.

But an id_token usually has an audience which is the RP, and a short expiration. A VC is issued for the user (aka holder), with long or no expiration to store in wallet.

A VC is bound to the user’s did (think pk thumbprint) and is useless without a proper presentation. A verifier does not expect just the VC but a V. Presentation signed by the user.

This is where using id_tokens as vcs will fall short. Once you give it to one verifier, you could assume is public.

The good thing about VCs is that is standard and easy to grasp. There are too many flavors though