This screen belongs to the gateway, not to spring-login-client — the same trust boundary a real identity provider's login page would have. See the live OpenID4VP demo for details on what gets verified (and what doesn't) in this reference implementation.