identifies the key to which the credential is bound, assigned by the client (equal to the credential id in Multipaz client implementation) or created by hashing the public key if client key id was not supplied; must be null for non-key-bound credentials