Currently, the SPC specification takes in a list of raw credential IDs:

dictionary SecurePaymentConfirmationRequest {
...
    required sequence<BufferSource> credentialIds;
...
};

It then maps those manually to PublicKeyCredentialDescriptors, in https://w3c.github.io/secure-payment-confirmation/#sctn-steps-to-respond-to-a-payment-request step 6:

6. For each id in data["credentialIds"]:

    6.1. Let descriptor be a new PublicKeyCredentialDescriptor dictionary, whose fields are:

        type: public-key
        id: id
        transports: A sequence of length 1 whose only member is internal.

    6.2. Append descriptor to publicKeyOpts["allowCredentials"].

Honestly I have no idea why we did this back in the day, but it is a bad idea - it forces additional complexity into the spec (we have to do this conversion) and it makes it harder to support non-internal transports.

I see two options for fixing this in a backwards compatible way:

1. Change credentialIds to have type sequence<BufferSource|PublicKeyCredentialDescriptor>, and change the spec to convert all BufferSource members into PublicKeyCredentialDescriptors when processing.
2. Add a new allowCredentials member of type sequence<PublicKeyCredentialDescriptor>, exactly like WebAuthn, and deprecate credentialIds.
   1. We would continue to support it in Chrome for backwards compatibility, mapping the way the spec currently does, but would push websites towards using allowCredentials.

Right now I lean towards the latter option (adding allowCredentials), but open to thoughts.