Error response for missing DPoP header

[ashwin-yo]

For the OAuth DPoP, what should the error response for the missing DPoP header be?

For example:

GET /protected-resource HTTP/1.1
Host: resource.example.org
Authorization: DPoP VALID_TOKEN

Should the error code be 400 or 401, and what should be the error and error_description here?

[rjsparks]

The datatracker repository is not where to report issues with or ask questions about the content of drafts - take those to the working group list (oauth in this case).