[dpark]

The real problem isn’t the revocation list itself. It’s just a list of numbers. If you get a credential that has been revoked it certainly tells you that it’s been revoked, but not much else. Assuming of course that it’s actually a revocation list being fetched and not a “is this particular cred revoked” call, because that would reveal that the cred is being presented to the caller.

The real question is how do you know when to revoke? How does the government know if a cred is being used by a minor or used broadly, indicating it’s been shared? These imply some sort of feedback from the entities accepting the creds and mean that the privacy guarantee is breached.

(I’m also not sure how revocation lists work with zero knowledge but maybe there is some crypto magic for that.)