notes: events/talks/kericonf26-d2-07-windley-legal-foundation

This data as json

path title type status classification words body
events/talks/kericonf26-d2-07-windley-legal-foundation Phil Windley: Digital Identity Needs a Legal Foundation (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 811 # Phil Windley: Digital Identity Needs a Legal Foundation (KERIConf 2026) **Abstract.** Phil Windley argued that the hardest remaining problems in digital identity are legal and institutional rather than technical, and that Utah's SEDI (State-Endorsed Digital Identity) statute supplies a legal foundation on which trust frameworks can rest. He covered the proof gap, the scaling and economic problems of trust, the rights in the statute, and two ways of building reputation. The talk is for builders and policy people working on decentralized identity adoption. ## Summary Windley began by noting that the technical foundations, decentralized key management, chained credentials, serialization formats and open-source implementations, are largely in place, though not finished. Adoption depends on removing blockers that are legal and institutional. He cited Sankarshan Mukhopadhyay's paper on the proof gap: people still rely on centralized institutions to prove facts about themselves, cannot easily present that proof digitally, and must go back to each institution when proof is lost. He framed two problems. The first is scaling trust. Using credit cards as his example, he described a trust framework as the combination of technology, rules, processes and legal agreements that lets many parties work together. With thousands of credential types, each in its own private framework, verifiers would face an unmanageable sea of islands, and coalitions that hope to grow large enough to cover everyone will never absorb their rivals. Something underneath that connects them is needed. The second problem is economic. In the 1990s, proofed certificates for people were costly because issuers took on liability, users would not pay, and the web settled on passwords. SEDI, he argued, helps with both. It is not a universal trust framework but a firm legal base beneath trust frameworks, and the state already proofs identity, for example for REAL ID driver's licenses. Under SEDI the person creates their own identifier, the state proofs attributes and links them cryptographically to that identifier, acting more like a notary than an identity provider. The statute affirms that identity is innate to the individual and independent of the state. Other government, institutional and even self-issued credentials can rest on that base. For organizations, business registration plays an analogous role, with GLEIF's LEI (Legal Entity Identifier) needed by those with global reach. He listed the statute's features: a bill of rights in law rather than in terms of service, selective disclosure, open standards with no vendor lock-in, a choice of wallets, a duty of loyalty that he called a first for identity data, and support for guardianship. People gain enforceable rights to obtain credentials, to have attributes amended, and to protection from arbitrary revocation, with complaints handled through a privacy ombudsman and the attorney general. An audience member added that there is no private right of action. He then distinguished reputation by reference, such as a diploma that can be chained to the holder's SEDI credential and to the university's accreditation and business credentials and checked automatically, from reputation by behavior, such as receipts for paying on time. Audience discussion explored whether these differ in kind or in directness, a marketplace of scoring algorithms, and whether people own or control data about themselves; he agreed control is the better word. He noted the same foundation supports agentic AI, including evaluator agents. He closed by saying SEDI is an opportunity but not a guarantee, that code alone cannot answer questions such as who may revoke, and that the legal foundation takes effect in May. ## Key terms proof gap, trust framework, SEDI, state endorsement, legal foundation, duty of loyalty, selective disclosure, reputation by reference, reputation by behavior, guardianship ## Claims and their evidence - The SEDI statute does not give a person an identity; it has the state endorse attributes and bind them to an identifier the person controls. [presenter-reported] - The statute includes a bill of rights, selective disclosure, open standards, a choice of wallets, a duty of loyalty and guardianship provisions. [presenter-reported] - Remedies under the statute run through a privacy ombudsman and the attorney general, without a private right of action. [presenter-reported] - Chaining a diploma credential to the holder's SEDI credential and to the issuer's accreditation and registration credentials lets a verifier check the whole chain automatically. [informative] - Proofed certificates for individuals failed on the web in the 1990s largely because people would not pay for the liability they carried. [presenter-reported] ## Related Utah's SEDI statute, the SEDI Summit held earlier that week, Sankarshan Mukhopadhyay's paper The Proof Gap, REAL ID, GLEIF and the vLEI (verifiable Legal Entity Identifier), the speaker's blog post on reputation for agents, Lawrence Lessig's code is law, Aadhaar and Estonia's digital identity (raised in discussion). ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (d2-07-phil-windley-digital-identity-needs-a-legal-foundation.md), all minutes read (the transcript ends at about 40 minutes of the listed 43:10). No quotations; paraphrase only. Not yet read by Mark.

Links from other tables