Function create_layer3_payment 

pub fn create_layer3_payment(
    serialized_l2: &str,
    mandate: &PaymentL3Mandate,
    agent_key: &EcdsaKeyPair,
    agent_kid: &str,
    iat: i64,
    exp: i64,
) -> Result<L3PaymentResult, ViError>

Create an L3a payment mandate signed by the agent’s key.

agent_kid names the key in the L2 mandate’s cnf.jwk.kid. It is a key identifier and not a key: credential-format.md §13.3 requires the header to carry kid and forbids a jwk, and §13.4 rule 7 gives the reason, which is that a verifier resolves the agent’s key out of L2 and must never trust one the L3 asserts about itself.