Trust Architecture
Verifiable credentials, digital product passports, cryptographic trust, and compliance verification.
Overview
Digital trust architecture means systems where a claim, a credential or a piece of compliance evidence can be checked by anyone, anywhere, without going back to whoever issued it.
Steven Capell is Vice-Chair of UN/CEFACT Digital Foundations and leads the UN Transparency Protocol, which 80 or so experts across 20 countries have built. Ashley Harwood is a UN Registered Expert and maintains the UNTP open-source reference implementation. Both sit on the W3C Working Groups for Verifiable Credentials and Decentralised Identifiers.
We do not advise on these standards. We write them.
The Problem
Compliance today runs on people assessing themselves, checked by auditing a tiny sample.
Consider the numbers. Australian Border Force audits find around 25% non-compliance, and they sample roughly one consignment in ten thousand. Product safety certificates are hard to locate and harder to confirm. As many as 70% of sustainability claims have been found false or misleading.
It is getting worse, because fabricating evidence keeps getting cheaper. AI will produce you a convincing PDF, a signature, even a hologram.
It will not produce you a valid cryptographic signature. That is the whole idea.
How It Works
The Verifiable Credentials Model
The W3C standard describes three roles, and they map onto things that already exist.
An issuer creates the credential: a government agency granting a permit, a certifier signing off a compliance certificate. A holder receives and keeps it, usually the exporter or the business it concerns. A verifier is anyone who needs to check it, a regulator or an auditor, and crucially need not know the issuer at all.
The issuer signs the credential. The verifier checks that signature against the issuer’s public key. Alter a single character and the signature stops matching.
What that replaces is “trust me”. What it puts there instead is “check it yourself”.
Digital Product Passports
A Digital Product Passport is a verifiable credential travelling with a product or a shipment.
It carries three things: what the product is, the third-party certificates behind any claim made about it, and the events marking its journey from origin to destination. Read it with a phone camera through a QR code, or have a compliance system read it automatically.
Tracing a whole supply chain means following links from one passport to the next, using identifiers that resolve. Nobody has to run the middle of it, which is the part that has sunk most previous attempts.
Applicable Domains
| Domain | Credential Examples |
|---|---|
| Trade & border | Certificates of origin, CITES permits, customs declarations |
| Agriculture & food | Deforestation-free certificates, organic certifications, food safety |
| Licences & permits | Business licences, building permits, export licences |
| Financial | Bank statements, insurance certificates, credit assessments |
| Education | University degrees, professional certifications |
| Health | Vaccination records, practitioner registrations |
From Manual Audit to Continuous Verification
The path runs in four steps, and each one works on its own, which is what makes it adoptable.
First the authority starts issuing verifiable versions of its documents, alongside the paper and PDFs it already produces. Nothing downstream has to change yet.
Then QR codes go on those documents, so any recipient who wants to check one can, inside whatever process they already follow.
Then systems start retrieving and checking structured credentials without a person involved.
At which point every credential in every transaction gets verified, and the only things a human looks at are the ones that failed.
Principles
- Protocol over platform. Central trust platforms, blockchain ones included, keep failing at the same hurdle: they need everybody on the same system. A protocol does not. Any organisation can join using whatever it already runs, provided it speaks the protocol. Vendors implemented AATP in weeks with free tooling.
- Inclusive by design. A grower in regional Australia and a multinational processor both have to be able to take part. So the same design covers scanning a QR code off a printed page and machine-to-machine verification at volume.
- Public good over proprietary advantage. The anti-counterfeiting protocols and the VCKit tooling went to the United Nations as open source. They were patentable. We did not patent them.
Policy Alignment
Everything is built on W3C Verifiable Credentials and Decentralised Identifiers, which our own staff help write as Working Group members.
GoSource leads the UN working group on digital trade facilitation, and UNTP is published under UNECE Recommendation 49. That matters for the EU Deforestation Regulation and the sixteen or more other EU sustainability regulations behind it: UNTP addresses the due diligence obligations directly, and the European Commission expects it to resolve the compliance problem facing EU industry.
Domestically, verifiable credentials run with the grain of the Australian Government’s direction on digital identity.
Evidence
The UN Transparency Protocol is the headline: a global standard led from here, built by 80 experts across 20 countries, endorsed by the European Commission.
Underneath it sit working systems. The Digital Verification Platform carries cross-border trade documents between Australia and Singapore, live on AWS with Ethereum anchoring. The ABF cryptographic credentials work implemented W3C VC and DID for border security, and produced VCKit, which went to UN/CEFACT as open source. The Australian Agriculture Traceability Protocol applies protocol over platform nationally, with Digital Product Passports proven in red meat, and we hold the mandate for its governance framework.
Steven Capell is Vice-Chair of UN/CEFACT Digital Foundations, UNTP project lead, and sits on both W3C working groups. Ashley Harwood is a UN Registered Expert, maintains the UNTP reference implementation and is a core VCKit contributor.
Standards and tooling: W3C Verifiable Credentials and Decentralised Identifiers, Open Attestation, VCKit, Digital Product Passports. Trust anchored to government domains, to Ethereum, and through resolvable identifiers. Verification by QR scanning, structured credential APIs and conformity rule engines. Built on AWS with Node.js, TypeScript and React.