spec: work to support DID and multiple credentials

Adding support for DID owners:

- Implemented by blinding the message hash
- Verifying a signature on the blinded message hash out-of-circuit

Adding support for combining multiple credentials:

- All credentials must have the same owner,
  but allows combining DID and PK owners.