The Identity Stack

Digital identity is easier to understand when it is separated into layers. Identity proofing occurs when a system attempts to establish that an applicant corresponds to a real-world identity or a set of validated attributes. Authentication occurs later when the enrolled user proves control of an account or authenticator. Federation allows one identity system to make assertions to another service. A wallet can carry credentials or act as an identity-provider component. The relying party is the service that ultimately decides whether the evidence is sufficient for access or a transaction.

NIST’s Revision 4 framework makes these layers explicit through identity assurance, authentication assurance and federation assurance. The point is not that every private website must implement the federal framework exactly. The value is analytical: a system can be strong at one layer and weak at another. A user may have a phishing-resistant authenticator connected to an identity that was poorly proofed. A government may perform strong proofing but force citizens to authenticate with weak recovery channels. A wallet may hold authoritative credentials but leak unnecessary attributes to relying parties.

Why Passwords Fail Structurally

A password is a shared secret. The user knows it and the server must maintain enough information to verify it. Humans then reuse passwords, choose memorable patterns, enter them into fraudulent sites and lose them through malware or credential breaches. Multi-factor authentication improves the architecture, but many common forms still rely on phishable one-time codes or push notifications. The fundamental weakness remains that users are trained to type secrets into websites.

Passwords also create a recovery paradox. The stronger the password policy becomes, the more likely users are to forget credentials, increasing dependence on reset channels. Those channels may rely on email, SMS, knowledge questions or customer-support staff. Attackers then target the reset system rather than the password itself.

Passkeys change the underlying authentication mechanism rather than merely strengthening password rules. That is why their significance is structural rather than cosmetic.

What Passkeys Actually Change

A passkey is a FIDO credential built on public-key cryptography. When a passkey is created for a service, the authenticator generates a cryptographic key pair associated with that relying party. The private key stays under the user’s authenticator or credential provider, while the public key is registered with the service. During login, the service sends a cryptographic challenge that the authenticator signs. The server verifies the signature using the public key.

The security improvement comes from the absence of a reusable password. There is no shared secret that can be stolen from the website and replayed elsewhere. The credential is bound to the relying party, which makes conventional phishing much harder because a passkey created for a legitimate domain cannot simply be presented to an impostor site as though it were the same credential.

The user experience also changes. Instead of remembering and typing a password, the user activates the passkey using the same mechanism that unlocks the device—a PIN, fingerprint, face recognition or other local activation method. FIDO emphasizes that biometric data remains on the device in normal passkey use; the website receives proof that the authenticator was successfully activated, not the user’s raw fingerprint or facial template.

Passkeys have also moved beyond experimental adoption. FIDO’s 2026 industry survey reported billions of active passkeys and widespread consumer familiarity, while a large majority of surveyed organizations said they were deploying, piloting or rolling them out in the workforce. Those figures come from FIDO-sponsored research and should be treated accordingly, but they establish that passkeys are no longer a niche authentication project.

Synced Versus Device-Bound Credentials

Not every passkey has the same operational architecture. A device-bound credential remains on a specific authenticator, such as a hardware security key or managed device. A synced passkey can be copied securely across a user’s devices through a passkey provider. The synced model is important for consumer usability because losing one phone does not necessarily mean losing access to every account.

NIST Revision 4 formally incorporates syncable authenticators. That is a significant policy shift because earlier high-assurance authentication models often assumed that cryptographic secrets should remain tied to one physical authenticator. Modern systems recognize that secure synchronization can improve usability and recovery while preserving phishing resistance, provided the synchronization fabric and account controls are sufficiently strong.

The tradeoff is concentration. A user may no longer depend on dozens of website passwords, but may depend heavily on one platform account or credential manager that synchronizes passkeys. The attack surface moves upward. Compromise of the passkey provider account, recovery process or device ecosystem can become more consequential. Strong authentication therefore reduces one class of risk while making provider-level account security more important.

Recovery Is the Hidden Attack Surface

Authentication systems are usually marketed through the login path. Attackers often prefer the recovery path. A service can deploy phishing-resistant passkeys and then undermine the entire design by allowing account recovery through weak email verification, easily hijacked phone numbers or poorly trained support representatives. A legitimate user needs a way back in after losing devices, but every recovery mechanism is also an alternative authentication mechanism.

FIDO’s own passkey guidance emphasizes that complete phishing resistance requires more than adding passkeys to the front door. Registration, recovery and fallback methods have to be hardened as well. If a password remains available as a fallback, a phishing attacker may simply force the user down the weaker route.

Recovery therefore belongs inside identity architecture, not customer service. High-value services should document what evidence can restore access, how long recovery takes, when human review is required and whether a recovered account receives the same privileges immediately. The security of a modern passkey system is determined partly by what happens after the user says, “I lost everything.”

Identity Proofing in the Deepfake Era

Authentication begins after enrollment. Identity proofing addresses the earlier question: who is being enrolled? That process has become much more difficult because remote enrollment often relies on the same media that generative AI can manipulate—photographs of identity documents, selfie video, face comparison and live video sessions.

NIST Revision 4 makes this threat explicit. Its identity-proofing requirements address digital injection attacks, forged media and deepfakes. Credential service providers are instructed to analyze submitted media for manipulation and to use authenticated protected channels. NIST also recommends device attestation or authenticated capture sensors where appropriate and human-in-the-loop cues during attended remote proofing.

The critical insight is that biometric comparison alone is no longer sufficient. A perfect face-matching algorithm can still be fooled if the system receives a forged face generated upstream of the comparison engine. The identity architecture therefore has to establish confidence in the capture process itself—where the image came from, whether it was modified and whether the human is actually interacting with the proofing system in real time. This changes identity proofing from “compare the face” to “secure the evidence pipeline.” Generative AI does not make remote proofing impossible, but it forces providers to treat media provenance and capture integrity as part of identity assurance.

Where Biometrics Belong

Biometrics can play several very different roles, and combining them creates privacy confusion. A phone may use a face or fingerprint locally to unlock a passkey. A remote identity-proofing provider may compare a live image against a government-issued ID. An airport may use biometric matching to associate a traveler with a travel document. These are distinct systems with different risk profiles.

Local biometric activation is comparatively privacy preserving because the biometric template remains inside the user’s device security boundary. The service does not need a copy of the fingerprint. Centralized biometric identification is more sensitive because biometric templates can become reusable identifiers across organizations and are difficult to revoke if compromised. A person can change a password; changing a face or fingerprints is not practical.

The strongest design principle is therefore to use biometrics as a local activation mechanism when possible and avoid turning the biometric itself into a universal identifier. A face should unlock a credential that proves something; the face should not need to become the credential presented everywhere.

The Digital Wallet Model

A digital identity wallet changes the direction of information flow. In a traditional identity system, a relying party may contact an identity provider directly or maintain its own copy of personal data. In a wallet architecture, an issuer provides a credential to the user, the wallet holds it, and the user later presents cryptographically verifiable information to a relying party.

NIST Revision 4 explicitly adds subscriber-controlled wallets to its federation model. In that architecture, the credential service provider can act as issuer, the user’s wallet acts as holder or identity-provider component, and the relying party verifies assertions from the wallet according to a trust framework. The relying party does not necessarily need a live direct connection to the issuer for every transaction.

This creates a meaningful shift in control. The user can carry credentials issued by different authorities and present them when needed. A government could issue a mobile driver’s license. A university could issue an education credential. An employer could issue a workforce credential. A bank could verify one attribute without becoming the permanent custodian of the complete source document.

The challenge is trust. A verifier must know whether it trusts the issuer, whether the credential has been revoked, whether the wallet is presenting authentic information and whether the holder is entitled to use it. Wallet architecture moves the identity problem; it does not make the trust problem disappear.

Verifiable Credentials

W3C’s Verifiable Credentials Data Model 2.0 became a formal Recommendation in 2025, giving the web a standardized way to express signed digital claims. A credential can represent familiar real-world assertions such as a driver’s license, diploma or other qualification. The model separates issuer, holder and verifier and defines how credentials can be cryptographically protected from tampering.

This standardization matters because digital identity ecosystems otherwise risk becoming incompatible wallet silos. If one government wallet, one university credential and one employer credential all use proprietary formats, each relying party has to build unique integrations. Open standards create the possibility that different issuers and wallets can interoperate.

W3C’s work also includes cryptographic integrity, status and revocation mechanisms. These details are essential. A digital credential cannot simply be a signed PDF that remains valid forever. The verifier may need to determine whether the credential was suspended, revoked or superseded without creating a privacy-destroying real-time tracking system.

Selective Disclosure and Derived Attributes

The privacy promise of digital credentials depends on not presenting the digital equivalent of an entire physical ID every time. A relying party often needs one property rather than the full record. A website may need to know whether the user is over eighteen. A rental company may need to know whether a driver’s license is valid. An employer may need confirmation of a professional credential. None of those transactions necessarily requires the verifier to collect every field contained in the source document.

NIST explicitly recognizes derived attributes and wallet-based federation as useful where an organization requires a defined list of attributes or does not need to retain the underlying data. W3C verifiable credentials support privacy-respecting presentations through the broader credential framework. The EU age-verification initiative provides the clearest mass-market example by designing an over-threshold proof that does not reveal the user’s exact age or complete identity.

This changes the privacy model from identity disclosure to attribute proof. The user does not always need to say “Here is who I am.” The user may only need to say “A trusted issuer has cryptographically attested that I satisfy this condition.”

Age Verification as the First Mass Privacy Test

Age verification has become one of the most politically contested digital-identity problems because the objectives conflict. Governments and platforms want stronger mechanisms to keep minors away from age-restricted content and products. Privacy advocates warn that requiring users to upload government identity documents to websites can normalize identity collection across the internet. The correct architecture has to prove age without creating a universal browsing identity.

The European Commission’s current approach is notable because it explicitly aims to separate the attribute from the identity. Its age-verification blueprint is designed to let a user prove that an age threshold is satisfied without revealing exact age, name or unrelated personal details. By April 2026 the Commission described the technical solution as feature ready and urged Member States to make it available by the end of the year.

The age-verification case will reveal whether privacy-preserving digital identity works outside technical standards documents. If relying parties accept minimal proofs, the technology can reduce unnecessary data collection. If sites still demand complete identity records “for safety,” the wallet may simply become another conduit for oversharing.

The European Digital Identity Wallet

The European Union is building the largest coordinated wallet deployment in the democratic world. Under the European Digital Identity framework, Member States are required to offer at least one EU Digital Identity Wallet to residents by the end of 2026. The wallet architecture is voluntary for citizens and is intended to support identification, public and private services and electronic attestations.

The Commission’s toolbox and Architecture and Reference Framework define common standards, protocols and information flows among issuers, wallets and service providers. The age-verification “mini wallet” is intentionally built on the same technical specifications so that it can serve as an early implementation and later integrate into national wallets.

The upside is interoperability. A credential issued in one national environment can be structured for verification across a broader European trust framework. The risk is scope expansion. A wallet designed to simplify government services could gradually become the default identity gateway for banking, travel, employment, communications or online access. Voluntariness, selective disclosure and anti-correlation protections therefore matter as much as cryptographic strength.

The political question is not simply whether the wallet is secure. It is whether citizens retain meaningful alternatives and whether relying parties are prevented from demanding more identity information than the transaction needs.

The U.S. Path: Standards Before One National Wallet

The United States is developing a more fragmented identity ecosystem. NIST provides federal digital-identity guidelines. States issue driver’s licenses and increasingly experiment with mobile forms. Technology platforms support wallet credentials. Financial institutions, employers and government agencies maintain separate proofing and authentication systems. There is no single universal national digital identity wallet equivalent to the EU architecture.

That fragmentation has disadvantages because citizens repeatedly prove the same attributes to different organizations. It also reduces the chance that one identity infrastructure immediately becomes mandatory across every domain. The likely U.S. path is interoperability through standards rather than one centralized identity account.

NIST Revision 4 reflects that model by describing multiple roles—credential service providers, identity providers, wallets, relying parties and federation authorities—rather than assuming one government identity database performs every function. The design challenge is to make those independent systems interoperable without turning a few platform companies into unavoidable identity gatekeepers.

Federation and Relying Parties

Federation allows a service to accept authentication or identity assertions from another trusted party. This is already familiar through “Sign in with” systems, enterprise single sign-on and government identity providers. Federation can improve security because the relying party does not need to manage every credential itself. It can also reduce passwords because users authenticate through a stronger upstream provider.

But federation creates centrality. If one identity provider becomes the gateway to hundreds of services, compromise or account suspension can have broad consequences. It can also create visibility into where users authenticate. Privacy-preserving federation therefore tries to limit unnecessary correlation and give relying parties only the information they need.

Wallets can reduce some centralization by allowing users to hold credentials and present signed assertions without forcing the issuer into every transaction. But wallet ecosystems still depend on trust registries, issuers, operating systems and verification software. The architecture becomes more distributed, not trustless.

The Correlation Problem

A digital identity system can protect the content of credentials while still harming privacy through correlation. If the same stable identifier is presented to every relying party, different services may be able to link a user’s activities even when they receive different attributes. If wallet providers can see every presentation, the provider may develop an extraordinary map of a person’s life.

NIST’s identity model recognizes pseudonymity and relying-party-specific identifiers as important design considerations. Privacy-preserving credential systems can also use selective disclosure and pairwise identifiers to reduce cross-service linkage. The objective is not anonymity in every transaction. A bank may legitimately need to know the customer’s identity. The objective is proportionality: services should not gain a universal identifier simply because the technology makes one convenient.

This is the central tension of digital identity. Cryptography can make credentials more trustworthy than paper while simultaneously making correlation more reliable than paper. A privacy-preserving system must intentionally resist that second property.

The New Attack Surface

Digital wallets and passkeys remove major classes of password theft, but they create new high-value infrastructure. Attackers will target wallet enrollment, recovery, device migration, issuer systems, wallet software, sync accounts and relying-party verification logic. Fraudsters will attempt to enroll fake identities using generative media. Malware will target unlocked devices. Social engineers will target recovery support. Criminals will search for ways to convince users to present legitimate credentials to malicious relying parties.

The security architecture therefore has to protect the whole lifecycle: proofing, issuance, activation, presentation, recovery, revocation and deletion. NIST’s Revision 4 is valuable precisely because it treats digital identity as a lifecycle rather than a login screen. Strong cryptography cannot compensate for weak enrollment or weak account recovery.

The more valuable the wallet becomes, the more consequential device compromise becomes as well. A phone that once contained email and payment apps may now contain government credentials, professional qualifications and strong authentication keys. Local hardware security, device attestation and rapid revocation become part of identity resilience.

Humans, AI Agents and Delegated Identity

The current NIST digital-identity guidelines focus primarily on human subjects rather than machine-to-machine authentication or APIs acting on behalf of users. That boundary is becoming important because AI agents are beginning to act inside the same digital economy. A service may soon need to distinguish “Stephen authenticated with a passkey” from “an AI agent acting under Stephen’s delegated authority initiated this transaction.”

The agent should not simply inherit the human’s identity. It needs its own machine identity plus verifiable delegation. The system should be able to prove which principal authorized the agent, which actions are permitted, how long authority lasts and whether the permission has been revoked. Article 003 called this the Agent Authority Test; Article 025 showed why the same structure matters legally.

This suggests the identity stack is becoming two-layered. Humans will increasingly authenticate with strong cryptographic credentials and wallets. AI agents will need workload identity and delegated credentials that trace back to those humans or organizations without exposing the human’s complete credential set to every automated tool. The future identity question is therefore not only “Are you really you?” It is also “Is this machine really authorized to act for you?”

What Is Actually Mature?

Digital identity technologies now sit at very different maturity levels. Passwordless passkeys are already broadly deployed. WebAuthn and FIDO2 are established standards. NIST Revision 4 is final guidance. W3C Verifiable Credentials 2.0 is a Recommendation. Subscriber-controlled wallet models are formalized in standards. The EU age-verification solution is implementation ready and national wallet rollout is underway. What remains unsettled is whether these pieces will interoperate cleanly across jurisdictions and whether privacy protections survive mass commercial deployment.

The SURVXCOM Digital Identity Test

The strongest identity system is not the one that knows the most about the user. It is the one that proves the required fact with the least unnecessary disclosure while remaining secure through enrollment, authentication, recovery and revocation. SURVXCOM therefore evaluates digital identity systems across twelve layers.

What to Watch Next

Passkey fallback removal. Passkeys become much more meaningful when services stop preserving weaker password recovery as a universal back door. Watch whether high-value accounts become fully phishing resistant across enrollment, authentication and recovery.

Cross-provider credential portability. FIDO and wallet ecosystems are working toward easier migration. Watch whether consumers can move passkeys and credentials between providers without becoming trapped in one platform account.

EU wallet rollout. The end-of-2026 wallet requirement creates a rare opportunity to observe digital identity at continental scale. Watch actual national availability, relying-party adoption and whether participation remains genuinely voluntary.

Age verification. Privacy-preserving proof-of-age is a critical real-world test. Watch whether platforms accept minimal age proofs or demand additional identity information.

Deepfake-resistant proofing. NIST has formalized the problem. Watch adoption of secure capture, device attestation, injection detection and stronger liveness/provenance systems.

Verifiable Credential 2.x interoperability. W3C’s 2.0 family is now a formal Recommendation and 2.1 work continues. Watch whether wallets and issuers converge on interoperable implementations rather than proprietary profiles.

Wallet privacy telemetry. A privacy-preserving credential can still become privacy invasive if the wallet provider learns every place it is presented. Watch architecture and policy around unlinkability and transaction visibility.

Recovery and redress. Mass identity systems inevitably reject legitimate people sometimes. Watch whether users can resolve errors without extraordinary effort, especially where credentials become necessary for government or financial access.

AI-agent identity. Human passkeys solve only the principal-authentication problem. Watch standards for delegated machine identity, workload credentials and verifiable agent authority.

Identity as infrastructure. The deepest question will be whether wallet systems remain optional tools or become gateways required to participate in ordinary digital life. Security improvement should not quietly become compulsory identity centralization.

The Identity Layer Beneath the Agentic Internet

The first internet identity problem was remembering passwords. The next identity problem is trust at machine speed. People increasingly expect to open an app and move money, sign a contract, access medical information, prove eligibility, communicate with government or authorize software to act on their behalf. Each action requires the system to know enough about the actor to make a decision, but not every action requires the system to know the actor’s complete identity.

Passkeys solve one important layer by replacing phishable shared secrets with cryptographic proof of account control. Digital wallets solve another by allowing trusted issuers to place portable credentials under user control. Verifiable credentials create standards for exchanging those claims. Selective disclosure and derived attributes reduce the amount of data that has to move. Strong identity proofing attempts to ensure the original credential is issued to the right person. Together, those technologies can create a safer and more private internet than the password-and-document-upload architecture they replace.

They can also create something much more centralized. If one wallet becomes the universal gateway to financial services, government, communications and age-gated websites, then losing the wallet account becomes a form of digital exclusion. If one operating-system vendor controls passkey synchronization for most users, the credential provider becomes critical identity infrastructure. If relying parties demand stable identifiers instead of minimum proofs, cryptographic credentials can make cross-service tracking more reliable. If governments make wallet use effectively mandatory, voluntary architecture can become compulsory through convenience and institutional pressure.

The correct objective is therefore not maximal identity assurance in every interaction. It is proportional assurance. A low-risk discussion forum may need very little identity. A bank opening an account needs much more. A website verifying an age threshold may need one derived attribute but not a legal name. A company authorizing an AI agent needs proof of the human principal and a separate credential describing the agent’s authority.

This proportional model is what makes digital identity compatible with liberty. Security does not require turning every digital interaction into a checkpoint. The technology is increasingly capable of proving narrow claims precisely because cryptography allows trust without complete disclosure.

That will become even more important as AI agents participate in transactions. The human may authenticate once and then delegate a bounded task to software. The relying party will need to know both that a legitimate principal exists and that the machine is authorized to perform the requested action. Identity becomes a chain: issuer, person, wallet, agent, credential, authority and transaction.

The identity layer beneath the agentic internet will therefore succeed or fail on architecture. Strong cryptography is necessary, but not enough. Recovery must be safe. Enrollment must resist synthetic media. Wallets must remain portable. Biometrics should remain local where possible. Relying parties should ask for the minimum claim. Users need redress when systems fail. Agents need delegated identities that do not blur the distinction between human intention and machine action.

Digital identity becomes trustworthy when it proves enough to support the transaction while preserving enough privacy and control that the user does not have to surrender a complete digital self in exchange for access. The architecture should strengthen trust in the claim while reducing unnecessary trust in every intermediary that handles it.