Other methods to bound a PK with an AT about draft-dpop HOT 3 CLOSED

The (#Confirmation) bit of that source text points to https://www.ietf.org/archive/id/draft-ietf-oauth-dpop-07.html#Confirmation which describes how to represent the binding for JWT access tokens and in token introspection responses. Other methods are possible, which something that comes from the conceptual foundation of OAuth in general. This draft says how to do it when using JWT or introspection but that's as far as it goes. The #Confirmation section(s) are their own sections and too much to be inlined or condensed.

from draft-dpop.

Question 1:
do the methods described in Section 6.1 - JWK confirmation , and in Section 6.2 - token introspection
satisfy the "MUST" requirements expressed in https://www.ietf.org/archive/id/draft-ietf-oauth-dpop-07.html#section-6 ?

Resource servers MUST be able to reliably identify whether an access token is bound using DPoP and ascertain sufficient information about the public key to which the token is bound in order to verify the binding with respect to the presented DPoP proof

Question 2:

Are the confirmation methods above either recommended or mandatory?

from draft-dpop.

1: yes
2: recommended

from draft-dpop.