Re: Utah State-Endorsed Digital Identity (SEDI) legislation

EU folks,

I wanted to simplify why I dislike the idea of requiring audited, certified
crypto hardware authorized by a commission and listed on a “list of lists”.

There are obvious reasons—like how inconvenient it is for me as someone
trying to provide solutions in this field—but there are also real concerns:

Here’s the deal:

While these practices can indeed be very secure—and can ensure proper
operational management, incident handling, etc.—what I cannot verify does
not add trust to a transaction.

I can verify that a request came from a certified origin by looking up
verification material from a list of lists, and given that those origins
have strict legal requirements, that indicates plausible trust. But it does
not verify that the actions creating the trust were actually performed.

Compare this to my example, where the relying party—the one that needs
trust—can always verify the things their trust relies on:

   -

   The machine acting as a digital proxy for an individual can verify that
   the wallet works as it should (for example: the distribution is signed and
   verified; the standardized code always requires frontend user verification
   for anything sensitive; and it provides direct programmatic access only to
   encrypted values for seamless backup, etc.).
   -

   Signatures made with a key derived from a physical ID, uploaded
   verifiably in the wallet, can always be verified by anyone they are
   presented to via a jurisdiction-specific registry holding the verification
   material and PID relevant in the given jurisdiction.
   -

   Courts/jurisdictions set the standard for what must be verifiable, but a
   globally recognized and supported blockchain keeps custody of verification
   material—so, for example: a public key and PID + an event log corresponding
   to a physical ID.
   -

   When contracts are signed, it is up to the liable party to take care of
   the contract, because they want to be able to show: “This other person
   signed the contract.”

These principles are interoperable for any data and could operate on global
technical standards, with jurisdiction-specific nuance on what must be
verifiable for something to be legally binding.

Decentralization like this works because everyone is responsible for (and
incentivized to fulfill) their own role for their own protection, and
everything is mathematically verifiable end-to-end—so any relying party can
verify what they specifically need to trust.

Now, there is probably/hopefully a tamper-evident history/log on the TSP
and other “list of lists” members that they must be able to present in
court. But they are still a single point of failure, making the system less
reliable for an individual’s legal safety. What I would like to understand
is: what exactly is the mechanism that ensures the event log presented in
court by a TSP is tamper-evident?

In my suggestion, this would perhaps be a central, audited, global
blockchain holding the verification material—a centralized trusted entity,
with a distributed system holding replicas and creating consensus.

Then you have a decentralized, fully distributed set of actors holding the
signatures that matter for their own legal safety.

And the blockchain is supported by anyone who wants to contribute to the
general trustworthiness of verification.

Tell me if I’m wrong, but in EUDI/eIDAS the legal safety of individuals
depends on the good will of the TSPs—because how do you audit or prove a
total system swap, or a total history rewrite, especially when they hold
both the signatures and the verification material?

This is exactly why some of us consider many of those grand statements and
audit groups, etc., to be security theater.

Because some of us understand: TRUST FROM WHAT YOU CANNOT VERIFY IS NOT
TRUST — IT IS CONVINCING (VIA A THEATER DISPLAYING: LOOK HOW MUCH WE ARE
DOING).

I’m not trying to demonize the legislation or say the EU is bad, but you
have to admit that the trust is, at best, plausible—and that it serves the
legal system and well-funded private-sector actors first.

Compared to my suggestion, where trust is always mathematically verifiable
to those that rely on it, and it serves individuals first, allowing real
competition and innovation by treating legally binding signatures as an
open primitive that anyone can build on.

It is also far more cost-effective, etc. The list of pros a system like
that has is massive.

Regards,
Jori