Verifiable credentials issuance

The W3C Verifiable Credentials Data Model lets any issuer sign a claim about a subject. Most VC issuers today use a single signing key — compromise the key, forge any credential.

For high-assurance credentials (university degrees, professional licenses, government IDs), a single issuer is a single point of failure. Threshold issuance spreads the signing authority across N parties; T-of-N must agree to issue.

When threshold VC issuance applies

Credential Why threshold
University degree Registrar + department head + dean must all agree
Professional license (medical, legal, engineering) Licensing board quorum required
Government-issued ID Multi-office approval workflow
Corporate appointment letter HR + legal + executive signoff
Audit certification Lead auditor + partner + independence reviewer

The threshold isn’t a technical decision — it’s the governance rule the institution already follows. Confium’s attribute-based threshold DSL encodes it directly:

role == 'registrar' and count >= 1
and role == 'department_head' and count >= 1
and role == 'dean' and count >= 1

What the issued credential looks like

A Confium-issued VC is a standard W3C Verifiable Credential with a composite signature proof:

{
  "@context": ["https://www.w3.org/2018/credentials/v1"],
  "type": ["VerifiableCredential", "UniversityDegreeCredential"],
  "issuer": "did:web:university.example.edu",
  "issuanceDate": "2026-07-31T00:00:00Z",
  "credentialSubject": {
    "id": "did:web:alice.example.com",
    "degree": { "type": "BachelorDegree", "name": "B.S. Computer Science" }
  },
  "proof": {
    "type": "ConfiumCompositeSignature2026",
    "created": "2026-07-31T00:00:00Z",
    "verificationMethod": "did:web:university.example.edu#confium-key",
    "proofValue": "base64-encoded composite signature",
    "threshold": { "of": 3, "parties": ["registrar", "department_head", "dean"] }
  }
}

The proof.threshold block is the audit trail — anyone verifying the credential can see who participated.

Verification

Verifiers use the standard Confium verifier (WASM in the browser, Python / Ruby server-side) to check the composite signature. The DID resolver fetches the issuer’s public key from did:web:university.example.edu and the verifier checks the composite signature against it.

No new DID method required — did:web, did:key, did:ion all work. The Confium composite signature is just another proof type.

Anchoring in a transparency log

Every credential issuance appends to a Confium Merkle transparency log:

  • The subject can prove their credential was issued (inclusion proof).
  • The issuer can prove they didn’t silently issue additional credentials (consistency proof).
  • Third-party watchdogs can mirror the log and detect split-view attacks.

For regulated credentials (medical licenses, government IDs), this is the difference between “we promise we issued N credentials” and “here’s the cryptographic proof.”

See also