Browser-Mediated Credentials Change the Web3 Trust Model

<p><strong>Analysis.</strong> On October 20, the World Wide Web Consortium published a new Working Draft of the Digital Credentials API. The draft would let a browser or other user agent mediate the presentation and issuance of credentials such as a driver’s licence, government ID or professional certificate. Six days earlier, W3C had also finalized a separate Recommendation for securing verifiable credentials with JOSE, selective-disclosure JWTs and COSE.</p> <p><strong>Thesis:</strong> the important change is not that identity has suddenly “moved on-chain.” It is that the browser is being designed as a policy boundary between a website, a wallet or credential manager, and the person being asked to disclose data. That could replace brittle QR-code and custom-app handoffs with a more consistent flow. It does not remove the need to decide which issuers to trust, what evidence is sufficient, or how little data a service should collect.</p> <h2>Draft transport, finished cryptography</h2> <p>The status distinction matters. The Digital Credentials API is a Working Draft on W3C’s Recommendation track. W3C explicitly says publication does not imply endorsement, and the document can still change or be replaced. The JOSE/COSE work published October 13 is a W3C Recommendation. It defines how credentials and presentations can use widely deployed signing and encryption formats, including selective-disclosure JWTs.</p> <p>Builders therefore have a relatively mature cryptographic building block alongside an unfinished browser interface. Treating both as equally settled would be a mistake. The sensible architecture is to isolate the browser-facing request layer from the credential-format and validation layers, so a draft API or protocol identifier can change without forcing a rewrite of trust policy.</p> <h2>What browser mediation actually changes</h2> <p>The draft requires user mediation for every operation. It also makes DigitalCredential instances origin-bound, requires a secure context, consumes user activation and gives the browser a role in choosing a credential manager. In plain language, a website should not be able to silently pull an identity document in the background. The user agent can show who is asking, which credential manager is involved and what is about to be shared.</p> <p>That is better than assuming a deep link or QR code carries enough context. It can also reduce the chance that repeated automated prompts become a new class of dark pattern. But a browser permission screen is not the same thing as informed consent. The draft’s own privacy section remains a work in progress and warns that long-lived identifiers can still enable fingerprinting, even when selective disclosure is used.</p> <h2>Data minimization becomes an integration requirement</h2> <p>Selective disclosure is not a decorative privacy feature. The draft calls it a fundamental data-minimization technique: a verifier should request the exact claims it needs. An age-restricted service, for example, should prefer an “age over” result to a full birth date or an entire identity document.</p> <p>That changes the product specification. Teams need claim-level requirements before they write the request. They should document the purpose of each field, how long the result is retained and whether the raw credential needs to be stored at all. In many cases, the durable record should be the decision, time, request purpose and assurance level—not a copy of the credential.</p> <h2>The browser does not decide whom to trust</h2> <p>A valid signature proves integrity and control of signing material; it does not automatically prove that the issuer is appropriate for a business decision. W3C’s Verifiable Credentials Data Model separates verification from validation. A verifier is still expected to evaluate validity periods, status or revocation, schema, fitness for purpose and whether the issuer is trusted to make the claim.</p> <p>This is the same design lesson behind <a href="https://jasonansell.ca/article/wallets-should-sign-outcomes-not-just-instructions">signing outcomes rather than opaque instructions</a>: a cryptographic success response is only one input to a policy decision. A hiring platform, lender and ticketing service can receive the same technically valid credential and reasonably reach different conclusions.</p> <h2>A six-part implementation checklist</h2> <ol> <li><strong>Keep protocol and format adapters replaceable.</strong> The API is format-agnostic, while its allowed protocols and browser support can evolve.</li> <li><strong>Request the minimum claims.</strong> Prefer predicates and selective disclosure to full documents whenever the use case allows it.</li> <li><strong>Bind the presentation to the session.</strong> Validate the requesting origin, audience, nonce or challenge, and expiry so a response cannot be replayed into another transaction.</li> <li><strong>Run validation after signature checks.</strong> Evaluate issuer trust, key status, credential status, schema, validity window and fitness for the specific purpose.</li> <li><strong>Log the decision, not the identity payload.</strong> Preserve enough evidence for audit and dispute handling without turning the verifier into a warehouse of high-value personal data.</li> <li><strong>Design a fallback.</strong> Unsupported browsers, operating systems, credential managers and accessibility needs will persist during rollout. A standards-based path should not become a new single point of exclusion.</li> </ol> <h2>What would change this assessment</h2> <p>The case for near-term production adoption becomes stronger when multiple independent browsers ship interoperable implementations, protocol conformance tests stabilize and the draft’s open privacy and security requirements are resolved. It becomes weaker if implementations expose materially different consent flows, require issuer-specific exceptions, or encourage sites to request more data merely because a digital credential is convenient.</p> <p>For Canadian builders, there is no need to pretend a W3C draft changes domestic identity law or creates an official Canadian rollout. The practical reason to pay attention is narrower: services operating across provinces or borders will benefit from separating credential transport, cryptography and local trust policy now, before browser support hardens those choices into product architecture.</p> <h2>Disclosure</h2> <p>Jason Ansell is a co-founder of Vector Smart Chain and an author of books about blockchain and Web3. Neither Vector Smart Chain nor any token is evaluated or promoted in this analysis. This article is not investment advice.</p> <h2>Sources</h2> <ul> <li><a href="https://www.w3.org/TR/digital-credentials/">W3C Digital Credentials API Working Draft</a>, October 20, 2026.</li> <li><a href="https://www.w3.org/TR/vc-jose-cose/">W3C Recommendation: Securing Verifiable Credentials using JOSE and COSE</a>, October 13, 2026.</li> <li><a href="https://www.w3.org/TR/vc-data-model-2.1/">W3C Verifiable Credentials Data Model v2.1</a>.</li> </ul>