SD-JWT only (KB must NOT be present)
SD-JWT + KB (KB must be present and sd_hash + signature must validate)