Re: When Technical Standards Meet Geopolitical Reality

Dear Carsten, all,

I fully support your view, that we need to define personhood and 
identity for both natural
and legal persons and I would love to see that our W3C community here 
defines the concepts,
data models and protocols aiming at global trust and interoperability.

Best Regards,
      Detlef

Am 10.08.2025 um 16:10 schrieb carsten.stoecker@spherity.com:
>
> Dear colleagues,
>
> I work every day in B2B and B2G identity. Pharma, financial services, 
> automotive, Industry 4.0, supply chain, energy, critical 
> infrastructure, public sector.
>
> My ask to the W3C community: stop treating private-citizen ID and 
> cypherpunk debates as the main use case and area of concern. They are 
> „super essential“, but not sufficient.
>
> We must define personhood as both, natural and legal personhood. We 
> need a broader frame. We must understand legal compliance and how 
> identity serves law and contracts. We must design solution patterns 
> that cover natural persons, legal persons, solo entrepreneurs, 
> employees, machines, and AI—while protecting privacy akin business 
> confidentiality in B2B. We must understand the boarder macro-economic 
> and cyber-security business case.
>
> **
>
> *TL;DR
> *
> Digital identity must go beyond private citizens. We need two wallet 
> tracks that coexist: personal wallets for people (e.g. EUDIW) and 
> business wallets for organizations (e.g. EUBW).
>
> Many high-value flows require “/legal proof of existence”/ (more 
> precise from my POV than “proof of personhood” for legal use) anchored 
> in government registers and IDs—for both natural and legal persons. We 
> are heavily using the term /legal proof of existence/ for legal 
> persons and recommend defining it for natural persons as well. 
> Government issuers are required where legal effect is needed.
>
> At the same time, use privacy tech (selective disclosure, no 
> phone-home, PETs) and allow multiple issuers to avoid single-point 
> control. The Solo-Entrepreneur continuum (BST→RSP) shows why 
> personal-only thinking fails: many one-person businesses need role, 
> license, audit, and delegation as well as much more advanced business 
> logic and credential integration with legacy systems and processes. 
> B2B/B2G delivers the macro-economic benefit and will drive wallet 
> adoption; trusted AI and machine identity must be first-class.
>
> Note: As Daniel Hardman noted in another discussion, identity for 
> natural persons must serve citizens, non-citizens, and stateless 
> people. The solution must be inclusive in technology and in law. 
> Without a way to provide a “legal proof of existence” for stateless 
> people, gaps remain. In many regulated use cases, they cannot use a 
> wallet without such proof. We must solve this with lawyers and 
> governments. This is a very hard problem. Because stateless people do 
> not vote, the electoral incentive is weak; many governments may not 
> prioritise it.
>
> Summary of my findings over the years
>
> *Shift the center of gravity:*
> Wallet business case adoption will be driven by B2B/B2G. These flows 
> need verified legal person identity, roles, mandates, seals, and 
> automation. Private-person use alone will not scale decentralised 
> identity infrastructure.
>
> **
>
> *Legal proof of existence is non-optional:*
> Contracts, KYC/AML, procurement, licensing, and due diligence require 
> an anchor in law. For people: civil ID. For companies: commercial 
> registers (EBRA, BRIS/EUID, EUCC, HGB). For legal effect, credentials 
> must be issued from—or derived from—governmental sources. There is no 
> way around this.
>
> **
>
> *Coexistence model: two wallets, one identity system design:*
>
> *   * Citizen Wallets such as EUDIW *for natural persons (including 
> professional attributes, QES integration).
>
> *   * Business Wallets such as EUBW *for legal persons (LPID/EUID, 
> VAT, licenses, QSeal integration).
>        Shared standards (W3C VC/VP) and trust lists; cross-recognition 
> across the EU, US (see recent NIST Special Publication 800–63–4 
> Digital Identity Guidelines), other jurisdictions.
>
> *
> Solo-Entrepreneur continuum (BST → RSP):*
> Many solos are voters and are frustrated by bureaucracy (e.g., 
> Germany). Therefore, solos are an extremely important identity 
> stakeholder group. A wallet ecosystem that ignores them is incomplete. 
> And they offer an excellent space to test our models.
>
> *   * BST:*simple business attributes in EUDIW; occasional QES.
>
> *   * RSP:*licenses (QEAA), retention, audit, delegated roles, 24x7, 
> automation, often a cloud business wallet. Step-up rules as assurance 
> and complexity rise.
>
> **
>
> *Source vs. issuer (from the email thread below), aligned with 
> compliance:*
> Keep government as the authoritative /source/ of legal existence. 
> Allow accredited providers as /issuers/. Use PETs and unlinkable 
> presentations so issuers do not “phone home.” This preserves rights 
> while meeting legal needs.
>
> *
> Roles, mandates, and workforce controls:*
> Bind employees to companies with verifiable roles/PoA (scope, value, 
> time). Support joint signatures, policy checks, and revocation/status 
> at scale.
>
> **
>
> *Machines and AI as first-class actors:*
> Issue credentials to systems and AI agents with chains back to a 
> responsible person or legal entity. Log authority use; enable 
> revocation and audit. If identity is not AI-ready, the solution will 
> fail.
>
> **
>
> *2×2 Matrix to pick the right controls:
> *Axes: Assurance requirements × Operational complexity.
>    Q1: low/low (private individual use, BST).
>    Q2: high/low (RSP, high-trust individual actions).
>    Q4: high/high (SMEs/enterprises with automation and deep system 
> integration).
>
> **
>
> *Government issuers + multi-issuer ecosystem:*
> Use government-backed credentials for legal existence (PID, EUID/LPID, 
> business licenses). Allow QTSPs and other accredited bodies to issue 
> attributes. Keep verification privacy-preserving.
>
> *
> Solution patterns to standardize:*
> Personhood-minimal schema; LPID/EUID corporate credential; role/PoA 
> and delegation chains (incl. AI); revocation/status lists; offline, 
> unlinkable VPs; LTV for signatures (XAdES-LT/LTA, PAdES); reference 
> flows for BST and RSP.
>
> **
>
> *CTA:
> *If we don’t expand beyond private-person use, we fail.
>
> We will miss the macro-economic use cases, under-serve solo 
> entrepreneurs, block enterprise automation, and be unfit for AI-driven 
> operations. The result: poor adoption, limited funding, and policy 
> drift away from decentralised identity patterns.
>
> Demand for trusted AI is super high. AI identity will set the standard 
> for the agent-based internet. We must act now: five weeks, not five years.
>
> *From:*Tim Bouma <trbouma@gmail.com>
> *Sent:* Sonntag, 10. August 2025 00:01
> *To:* Daniel Hardman <daniel.hardman@gmail.com>
> *Cc:* Manu Sporny <msporny@digitalbazaar.com>; public-credentials 
> (public-credentials@w3.org) <public-credentials@w3.org>
> *Subject:* Re: When Technical Standards Meet Geopolitical Reality
>
> Personally, I’ve come to the conclusion that we require a protocol 
> where the core primitive is ‘issuance’ (signing) such that there is no 
> privileged role of ‘issuer’ and/or ‘verifier’. Anyone using this 
> so-called protocol, no matter how disadvantaged they might be, must be 
> on equal footing with the strongest of users, namely government.
>
> As things stand now, the current protocols simply reinforce the status 
> quo, and for the majority that’s ok, or don’t know anything 
> differently. That’s also ok, for the current generation of solutions, 
> but we need to start looking past that horizon.
>
> Tim
>
> On Sat, Aug 9, 2025 at 5:50 PM Daniel Hardman 
> <daniel.hardman@gmail.com> wrote:
>
>     >> I would like to share an experience so that my strong words have some softening context.
>     >I wanted to come back to this email, as it's been echo'ing in my head
>
>     Thank you for the kind and thoughtful response, Manu.
>
>     >> I think it is dangerous to build an ecosystem where proof of personhood is
>     largely assumed to come from governments.
>     >Yes, agreed; that should not be the only source, but I expect it
>     will be a primary source for some time to come.
>
>     I'd like to clarify my mental model, because there seems to be
>     both important alignment and important divergence between mine and
>     yours, Manu.
>
>     Speaking of government, you used the phrase "be the only source".
>     My language was similarly general "proof of personhood comes
>     from". In a sense, it might seem that we're saying almost the same
>     thing. But Let me get more granular.
>
>     I have no problem at all with the idea that a government-governed
>     process should be the common/default "source" or where "proof of
>     personhood comes from" -- in the near term or into the infinite
>     future. My beef is with the easy conflation of "source" and
>     "issuer". A government process can produce personhood evidence,
>     but I don't want the identifier of the government to be used as
>     the *issuer* of that evidence. EVER. Hard stop, exclamation point,
>     non-negotiable human rights core principle that we don't stray
>     from even in version 0.1 of a system. And I believe we can
>     actually achieve and enforce this by being very careful with our
>     definitions, which is why I'm trying to be so picky about language.
>
>     On what basis could we maintain the distinction between "source"
>     and "issuer"? In my mind, an acceptable process for issuing
>     personhood evidence would be whatever the government designs, and
>     could use whatever infrastructure the government provides -- but
>     would result in issuance by a named human being who has a publicly
>     known legal identity endorsed by that government for issuance of
>     personhood credentials. This would make proof of personhood just
>     like an adoption decree -- signed by an individual human judge who
>     has delegated legal authority from the government -- NOT signed by
>     "the government" as an impersonal bureaucracy.
>
>     I also don't want any fields in a personhood credential to attest
>     to any characteristics of legal identity, because legal identity
>     characteristics are changeable, whereas humanity is not.
>     Conflating the two is dangerous. The only fields that should exist
>     in a personhood credential are various biometrics and metadata
>     about the issuance/level of assurance. A government credential
>     that attests to legal identity for a person is derivative of, not
>     equivalent to, proof of personhood, and modeling it any other way
>     is both a concept error and a human rights violation. It elevates
>     government opinion about legal identity facts to a place those
>     facts do not belong, which is on the level of human dignity.
>
>     If we do it the way I'm recommending, then tribal elders or doulas
>     in remote highlands somewhere naturally function as peers of
>     judges, which is factually accurate, reasonable, just, and
>     inclusive. The only difference between their evidence output is
>     whether you like the governance -- again, factually accurate,
>     reasonable, just, and inclusive. If, on the other hand, "the
>     government" is the issuer of proof of personhood -- or if we have
>     fields in the schema of such a credential that only governments
>     can attest to -- we permanently prevent humans from becoming peers
>     of institutions on the question of humanness.
>
>     --Daniel
>
>     On Sat, Aug 9, 2025 at 11:40 AM Manu Sporny
>     <msporny@digitalbazaar.com> wrote:
>
>         On Sun, Jul 20, 2025 at 6:40 PM Daniel Hardman
>         <daniel.hardman@gmail.com> wrote:
>         > I would like to share an experience so that my strong words
>         have some softening context.
>
>         I wanted to come back to this email, as it's been echo'ing in
>         my head
>         for the past several weeks and I wanted to acknowledge the
>         sharing of
>         a personal experience, thank Daniel for sharing it, and recognize
>         where Daniel is coming from... which is from one of many
>         acutely human
>         experiences, which I hope is what we're all trying to improve
>         with our
>         work.
>
>         For those of you that might have visited countries where you show
>         your, or your child's, only form of international
>         identification, only
>         to have (without warning) security personnel walk away with it or
>         suggest that they will keep it, is terrifying. The flush of
>         adrenaline; the heat on your face, hits you before you can process
>         what's going on. I'm sorry you had that experience, and I'm
>         glad it
>         worked out in the end... and both you and I know it does not
>         always
>         work out in the end.
>
>         > How does this relate to personhood credentials? I think it
>         is dangerous to build an ecosystem where proof of personhood
>         is largely assumed to come from governments.
>
>         Yes, agreed; that should not be the only source, but I expect
>         it will
>         be a primary source for some time to come.
>
>         > If we raise the stakes further -- governments now decide who
>         the rest of the world can/should believe is human (and thus
>         worthy of human rights), I think we are truly in scary territory.
>
>         I agree.
>
>         > Doctors or nurses who sign birth certificates should be able
>         to attest humanness. Tribal elders should be able to attest
>         humanness. Government vetting processes that prove humanness
>         should be signed by a human employee, not by the government
>         itself, because it is the human rather than the bureaucracy
>         that is safely definitive on this question. We should NEVER
>         forget this.
>
>         Yes, also agree.
>
>         I would hope that most in this community would agree with all
>         of the
>         above. What concrete set of things to do about it is the
>         question...
>
>         My hope is that focusing on a few things help:
>
>         * Ensure that one can prove things about your or others in a
>         way that
>         is so broadly disseminated that "confiscating the original
>         documents"
>         becomes something that cannot happen. That is, ensure broad
>         dissemination, true ownership, and consent over transmission of
>         digital credentials.
>
>         * Ensure that one can prove things about yourself at the
>         proper level
>         of pseudonymity for the transaction. That is, no phone home, prove
>         things in zero knowledge, etc.
>
>         * Ensure that fundamental human rights are not centralized
>         purely with
>         government bureaucracies. That is, enable a broad base of
>         issuers and
>         many equivalent roots of trust.
>
>         I think the folks in this community endeavoring to standardize
>         stuff
>         are actively working on at least the three items above, but at
>         levels
>         that are frustratingly slow. We're putting a lot of effort
>         into the
>         first bullet item, trying as hard as we can to move the second one
>         forward (but have been slowed by the painfully slow IETF CFRG
>         review
>         process and a disinterest by a number of governments and private
>         industry in funding the work), and are missing a truly compelling
>         solution for the last item (though birth certificates and
>         notaries do
>         provide for alternate, positive paths forward... alongside local
>         government agencies).
>
>         I don't expect any of this will reduce the feeling of concern
>         about
>         proof of personhood and government intervention in that
>         regard. I just
>         wanted to note that we are working on technologies that I hope
>         align
>         more with addressing your concerns than ceding all authority on
>         human-ness to large and indifferent bureaucracies of any kind.
>
>         -- manu
>
>         -- 
>         Manu Sporny - https://www.linkedin.com/in/manusporny/
>         Founder/CEO - Digital Bazaar, Inc.
>         https://www.digitalbazaar.com/
>
>
> Spherity GmbH <https://www.spherity.com/>|Emil-Figge-Straße 80|44227 
> Dortmund
>
> LinkedIn <https://www.linkedin.com/company/spherity>| X 
> <https://twitter.com/spherity>| YouTube 
> <https://www.youtube.com/@spherity2407>
>
> Managing Directors: Dr. Carsten Stöcker, Dr. Michael Rüther
>
> Registered in Dortmund HRB 31566
>
-- 
Dipl. Inform. (FH)
Dr. rer. nat. Detlef Hühnlein
ecsec GmbH
Sudetenstrasse 16
96247 Michelau
Germany
Phone  +49 9571 948 1020
Mobile +49 171  9754980
Maildetlef.huehnlein@ecsec.de

ecsec GmbH
Sudetenstrasse 16
96247 Michelau
Germany

Registered at Court of Coburg HRB 4622
EUID: DED4401V.HRB4622

Directors:
Tina Hühnlein
Dr. Detlef Hühnlein

This e-mail may contain strictly confidential information and is intended for the person to which it is addressed only. Any dissemination, even partly, is prohibited. If you receive this e-mail by mistake, please contact the sender and delete this e-mail from your computer, including your mailserver. Except in case of gross negligence or wilful misconduct we accept no liability for any loss or damage caused by software or e-mail viruses.