TokenUnlockPass
Token-unlock material scoped to one temporary-pass namespace.
The access document is presented to the lock, while readerGroups provides the issuer trust material needed to authenticate a lock's reader certificate.