[atonse]

Thanks for the background. For fun I did a thought experiment a couple weeks ago, of designing a vaccine verification system and arrived at the same cryptographic abstractions (without JWT and JWS, but same for offline verification with public keys) and it’s good to see the design matches mine, mainly as a validation to myself that I am understanding a practical application of those crypto building blocks.

The added bonus is there’s already an open standard I can use that’s been poked at by smarter people.

Exciting!

[rocqua]

The real interesting part here, if you want to start making this more widely available, is determining whose signatures you trust.

Self-signed statements already have some value. You can litigate those in court. But when you wanna enter e.g. the Netherlands, how are they to know which key belongs to Quebec?