require Signed DCAPIRequests
Refuses an unsigned OpenID4VP request over the Digital Credentials API: Wallet.startDCAPIPresentation throws untrustedVerifier, before the holder sees it. Its only identity is the origin the platform reports; HAIP requires a wallet to support unsigned requests, so set it only where every Verifier must be one verifierRoots accepts.