A citizen should be able to prove something without the state learning where they proved it.

One · The anchor belongs to the state, not to the supplier

Credentials are signed under a domain the authority already controls, and every verifier resolves that domain to check them. There is no vendor identifier in the credential, no platform namespace, and no sub-account. A ministry's credentials are signed by the ministry, in the ministry's own name, and read as such by anyone on earth.

This is the difference between owning an identity scheme and renting one. A scheme anchored in a supplier's namespace has handed that supplier a veto over its own future; a scheme anchored in a national domain has not.

{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/suites/jws-2020/v1"
  ],
  "id": "did:web:orbis.id",
  "verificationMethod": [
    {
      "id": "did:web:orbis.id#key-1",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "MupKZa26RgQMQasnNxv4eDIS7XzIpGfDA4a9Y4TJvYY", "y": "oo_fTfpVOyJSpQmS9VaMuby4WCi55pzDhd0BklllVYc" }
    },
    {
      "id": "did:web:orbis.id#key-2",
      "type": "JsonWebKey2020",
      "controller": "did:web:orbis.id",
      "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "53l5yME2Ut_Fx_S3wpCfN2lVCPaWOXheNxH4GZpj8Is", "y": "YIQijcuvassCjvvio3d7EuiRcGHYdMbZtFjf2huszck" }
    }
  ],
  "assertionMethod": ["did:web:orbis.id#key-1", "did:web:orbis.id#key-2"]
}

Two · The issuer cannot watch the citizen. Not "does not" — cannot.

This is the requirement that decides whether a national scheme is trusted or resented, and it is usually answered with a policy. A policy is a promise about what an organisation will refrain from doing with a capability it has. We would rather not have the capability.

When a citizen shows a credential, the party checking it does not contact the authority that issued it. It reads two public documents — the keys, and the withdrawal list — and does the arithmetic itself. There is no request that arrives at the issuer, so there is nothing to log, nothing to subpoena, and nothing for a future administration to repurpose.

The arrow that is missing is the one that matters. Whoever vouched for you never learns where you went — and the reason is not restraint, it is that the arrow was never built.

Three · Withdrawal at national volume, without a surveillance log

A scheme needs to withdraw credentials — an entitlement lapses, a licence is suspended, a document is reported lost. The obvious design is an endpoint that answers questions about one credential at a time, and that design is a movement log wearing a different hat.

Instead the withdrawal list is published whole, signed, and compressed hard enough that reading all of it is cheaper than querying one row. A verifier that downloads the entire list has revealed nothing about which entry it cared about.

curl -s -D- -o /dev/null https://id.orbis.id/status/1 | grep -i content-type

Four · The exit, priced before the procurement

Departure costs one DNS record. We think that is the only honest way to sell infrastructure to a state: make leaving cheap, and then earn the renewal every year.

In practice that means an authority that leaves keeps serving three small static files under its own domain, and every credential it ever issued keeps verifying. No migration, no data extraction, no re-issuance to citizens, and no negotiation. We would rather that be written on the website before the tender than discovered in year four. The three files, measured, with the commands.

The permissionless plane, counted

The claim underneath all three arguments is that the checking path takes no credential of any kind. That is countable rather than arguable: the service publishes its own contract, every operation is labelled with the authorisation it demands, and the labels can be tallied.

curl -s https://id.orbis.id/openapi.json | jq '[.paths[][]["x-auth"]] | group_by(.) | map({(.[0]): length}) | add'

What a public body would actually be procuring today.

curl -s https://id.orbis.id/api/site/register | jq -r '.entries[].slug'

Straight answers

Can you name a government using this?

No. We would very much like to and we are not going to imply one in the meantime. The honest position is that the mechanism is live and the deployment list is empty.

Is this certified under eIDAS?

No. A conformity assessment has not been sought and the HAIP conformance suite has not been run. What we can show you is the wire behaviour and the standards it implements, each with its own state, and the honest gap between those two things.

Where is citizen data stored?

In your systems, where it already is. We mint and revoke signed statements about facts you hold; we do not ask for the register behind them and there is no copy of it here. Held credentials and consent live on the citizen's own device.

What happens to citizens if the supplier fails?

Every credential already issued keeps verifying, because verification reads documents under your domain and never ours. New issuance would stop. That asymmetry is the point: our failure is an inconvenience to the authority and not an emergency for the population.

Can a citizen be compelled to show more than was asked?

Not by the protocol, and that is worth being precise about. Each claim is individually blinded, so the extra fields are not withheld from the message — they are not in it. What the protocol cannot govern is a party with power over a person insisting on more, which is a question for law and not for cryptography. Where the law does and does not require this.