Credentials

Every credential in Glemo is a W3C Verifiable Credential 2.0, Open Badges 3.0 is a profile of it. That means credentials are portable, tamper-evident and belong to their holder, not to a platform.

There are two profiles today. Open Badges 3.0 is for what a person achieved: it carries an achievement, its description and its criteria. UNTP Digital Conformity Credential 0.7.0 is for a self-declared statement about an organisation, and it carries none of those, because a conformity attestation has no achievement to describe. It names the assessed party, the scheme it was assessed against, and how independent the assessor was.

That last field is not decorative and it is never hidden: assessorLevel says whether the organisation assessed itself or a third party did, and a conformity claim cannot be judged without it.

What Glemo issues today is self-declared. The credential goes out with assessorLevel: self, assessmentLevel: no-endorsement and attestationType: declaration, and those values are never selectively hidden. A self-declaration is a real, useful document, and it is not accredited conformity: regimes that require an accredited assessor, EUDR among them, are not satisfied by one, and we would rather say so here than let the standard's name imply otherwise.

Anatomy

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"
  ],
  "id": "urn:uuid:…",
  "type": ["VerifiableCredential", "OpenBadgeCredential"],
  "issuer": { "id": "did:web:university.edu", "name": "University" },
  "validFrom": "2026-01-01T00:00:00.000Z",
  "credentialSubject": {
    "id": "did:web:holder.example",
    "achievement": { "name": "Solidity 101" }
  }
}

Issuers and DIDs

Issuers are identified by a DID (did:web:university.edu), resolved to a public key published at their own domain (/.well-known/did.json). No central registry decides who can issue, the web of trust is the issuer's domain plus Glemo's verification layer.

Our own keys

Glemo signs things too: the status list credentials, and the receipt every verification returns. Those keys are published as a JWK Set (RFC 7517) at /.well-known/jwks.json, which is a different surface from the issuer did.json above: that one answers who signed this credential, this one answers who signed what Glemo told you about it.

The set carries superseded keys as well as the current one. A receipt signed last year has to keep verifying after a rotation, so removing an old key would silently invalidate evidence somebody is holding.

Proof

Credentials are signed as VC-JWT (ES256). Any change to any claim breaks the signature. Personally identifiable information stays off-chain; only a hash/commitment can be anchored.

Revocation

Revocation uses the W3C Status List standard: a compressed bitstring served as a credential itself. One bit per credential, herd privacy included. See Verification for how verdicts are computed.