Trust Registry

Overview

The public exact-ID registry and Passport reader recalculate current status from the signed scoped claim, assessment, evidence, expiry, and revocation state without returning private evidence. It has no active entries until an authorized independent assessment issues a certificate. Technical issuance alone does not establish independent certification.

• Check the canonical API origin and exact certificate ID.
• Verify the signature against an issuer key you already trust; an embedded key alone is not a trust anchor.
• Treat EXPIRED, REVOKED, SUSPENDED, INVALID, and unavailable as not current.
• Do not treat an absent entry as evidence of safety or unsafety.

Production checklist

• Keep credentials in a server-side secret store.
• Set explicit cost, latency, privacy, provider, and regional constraints.
• Capture route and evaluation evidence for incident review.
• Test timeouts, cancellation, fallback, and denied-policy paths before rollout.