In provided examples for RSA OAEP Cose Decrypt objects RSA-OAEP algorithm type is put into unprotected section of recipient.
It sounds more accurate to me to to put it into "protected" section of recipient.
RFC8230 and RFC8152 are not precisely defining where "alg" should be put for RSA-PSS and RSA-OAEP objects.
In provided examples for RSA OAEP Cose Decrypt objects RSA-OAEP algorithm type is put into unprotected section of recipient.
It sounds more accurate to me to to put it into "protected" section of recipient.
RFC8230 and RFC8152 are not precisely defining where "alg" should be put for RSA-PSS and RSA-OAEP objects.