Privacy-preserving credential anchoring: a few design questions and feedback

Hi everyone,
I’m a new dev and I've been prototyping a privacy-preserving credential
state layer built around Verifiable Credentials and ZK proofs, and I'd
appreciate feedback on the architecture before I get too far into
implementation.
My initial design (v1) was fairly straightforward: holder and issuer each
have an address on-chain, and the issuer publishes a Merkle root of a
certificate anchored against the holder's public address. The holder then
proves possession via a Merkle proof or a zk-STARK.
However, one issue I ran into is public address and certificate root
correlation. Since roots are published against a known issuer address
(e.g., a university's known public address), a verifier immediately learns
which issuer the credential came from just by observing which address the
root is tied to and if issuer and verifier collude, the holder's public
address further narrows down who they are.

To reduce this metadata leakage, I'm exploring maintaining a global
authenticated accumulator of issuer states so that holders prove membership
against a global root rather than an issuer-specific root, with leaves
constructed as commit(secret, H(attributes)) — the holder-chosen secret is
sent to the issuer over an encrypted channel and never appears in the
clear, similar in spirit to link secrets in CL/AnonCreds, but
membership/predicate proofs are done via ZK-Merkle inclusion (STARK) rather
than a pairing-based blind signature.
I'm currently considering two trust models:

Design A – App-specific Validium

Issuers submit credential roots to a sequencer.
 - The sequencer maintains the global state.
 - Every state transition is accompanied by a ZK proof showing that
previously committed issuer roots were preserved correctly and only valid
 updates were applied.
 - The sequencer cannot modify existing issuer state or fabricate
credentials for an existing authorized issuer.
 - Revocation and routine field updates (address, employment status, etc.)
use the same mechanism, issuer signs a new value for an existing leaf,
sequencer proves in-circuit it changed only that leaf, so a verifier can't
distinguish a revocation event from an unrelated metadata update.
 - The remaining trust assumption is governance: whoever controls issuer
authorization must not approve malicious issuers. This isn't a crypto
problem to solve, more a CA-trust-in-X.509-style problem — I'm looking at
whether CT-log-style public, auditable issuer registries are established
practice for this in the VC space.

Design B – Stateless aggregation

 - Each issuer maintains its own authenticated state.
 - An aggregator periodically computes a global accumulator from
issuer-published roots.
 - The smart contract independently verifies the proposed global state from
issuer-authenticated data, removing trust in the aggregator.
 - The trade-off is higher on-chain verification costs and more work for
issuers — every issuer update and every accumulation step is an on  chain
Merkle operation, which scales poorly with update frequency. This is
functionally the same reason general-purpose validiums exist for blockchain
scaling generally, just applied to credential anchoring.


1. Is aggregating issuer state into a global accumulator a meaningful
improvement for reducing issuer-verifier correlation, or am I  overlooking
other metadata channels (timing correlation, out-of-band context) that
would largely negate the privacy benefit?

2. Between these two trust models, which aligns better with the design
philosophy of the VC ecosystem? Is introducing a stateful sequencer a
reasonable trade-off for lower verification costs, or would a fully
verifiable stateless design generally be preferred despite the additional
cost?

Thank you for any guidance

Suyash