client (the authenticated caller's registration),
introspection, issuer, advertised and an optional now
a promise of { contentType, body, alg, enc }; it rejects with a
sentence fit for an error_description when the registration cannot be
honoured
Signs, and where the client registered it encrypts, an introspection response for the authenticated resource server.
A signature may be post-quantum and slow, so it goes through libuv's thread pool.