A valid digital signature can help establish where a verifiable credential came from, but organizations must separately decide whether its issuer has authority to make the claim.
The World Wide Web Consortium (W3C) adopted Verifiable Credentials Data Model v2.0 as a Recommendation on May 15, 2025. The standard distinguishes technical verification of a credential's origin, conformity and applicable status from accepting its claims as true. It leaves decisions about which issuers to trust for particular purposes to the verifier.
A credential reaches a verifier through its holder after an issuer has made an assertion. Recognizing the issuer's signing key does not give every claim signed with that key the same standing. The organization receiving the credential must decide whether the issuer is a source it will accept for the claim at hand.
That distinction applies to identity proofing, one possible use of digital credentials. The U.S. National Institute of Standards and Technology (NIST) includes mobile driver's licenses among forms of digital identity evidence. Its guidance calls for validating the evidence and checking that the applicant is the person to whom it was issued. How rigorously the evidence was issued also affects its strength.
The place where verification records are published does not make the trust decision. W3C lists blockchains, websites and peer-to-peer systems as possible ways to publish such records. A verifier can use the information they provide while still having to decide which issuers' claims meet its requirements.
A credential's standing can also change after issuance through revocation or suspension. Checking its status can help a verifier avoid relying on a credential that is no longer acceptable. W3C warns, however, that a poorly designed check could tell an issuer which verifier is interested in a particular holder's credential, creating a privacy risk for the holder.
