DIDs & verifiable credentials

In one line

A DID is an identifier you control via cryptographic keys (no central registrar); a verifiable credential (VC) is a signed claim — "this person holds this qualification" — that anyone can check mathematically against the issuer's keys.

The problem it solves

Today, checking a credential means phoning the issuer: is this nursing licence real, is this certificate genuine? It's slow, manual, and forgeable PDFs slip through. DIDs and VCs replace the phone call with math: the credential carries the issuer's cryptographic signature, so anyone can verify it instantly, offline, without contacting the issuer.

The trust triangle

Three roles (the diagram above):

• Issuer — a university, council, or platform signs a credential bound to the holder's identifier.
• Holder — the person stores it in a wallet and presents it when needed.
• Verifier — an employer or system checks the signature and revocation status against the issuer's public keys — no callback to the issuer required.

The clever parts

• DIDs — identifiers you control through keys, resolvable without a central registrar.
• Selective disclosure — present only what's needed ("over 18" without the birthdate; "holds an active licence" without the licence number).
• Revocation — a credential can be checked against a revocation list, so a withdrawn licence fails verification.
• Open Badges 3.0 aligns education credentials with this model.

Where it shows up in digital health

• Clinician licence verification across states and borders — instant, tamper-proof.
• Tamper-proof training certificates.
• Health-data sharing consents as signed artefacts.
• Vaccination certificates — India's DIVOC-issued COVID certificates were verifiable credentials at national scale.

This platform's SIDHI certificates are planned as VCs from day one — decided in ADR 0010 precisely because credential formats are painful to retrofit. An employer will verify a SIDHI credential in seconds, which is much of its value.

Common pitfalls

• Issuer key management — the whole trust chain rests on the issuer's keys; lose or leak them and credentials are worthless or forgeable.
• Ignoring revocation — a signature that's valid but revoked must fail; build the check in.
• Over-collecting — VCs enable selective disclosure; asking for the full credential when you need one attribute wastes that privacy win.

Key takeaways

• A DID is a self-controlled identifier; a VC is a cryptographically signed claim.
• The issuer → holder → verifier triangle removes the "phone the issuer" step entirely.
• Selective disclosure and revocation make them privacy-respecting and trustworthy.
• The foundation for instantly-verifiable SIDHI credentials — and already proven at national scale (DIVOC).