Consider an illustrative graduate applying for a job. The employer needs to confirm a qualification, but receives a complete certificate containing a name, student number, programme, study dates and institutional signatures. The document may then be scanned, emailed and stored again while someone contacts the university to check it.

A photocopy contains information. It does not automatically prove who issued it, whether it has been changed or whether it remains valid. Repeated copies also spread personal information beyond the original purpose.

The next digital-credential opportunity is to make trusted claims portable rather than build larger stores of copied documents. For African institutions, the value lies in improving a real decision: verifying the evidence that matters, recognising a credible issuer and avoiding disclosure that the recipient does not need. The objective should be proofs, not photocopies.

A signed claim changes the evidence exchange

A verifiable credential changes the exchange.

The university issues a cryptographically signed digital credential. The graduate holds it in a digital wallet or another authorised storage method. When an employer needs evidence of the qualification, the graduate presents the relevant credential or a proof derived from it.

The verifier checks signature integrity and whether the issuer is trusted for that particular claim. Expiry, status and presenter entitlement depend on the credential and presentation design: not every credential is revocable or cryptographically bound to its holder. Where those checks are required, the system must provide a supported mechanism and clear acceptance rules.

The employer may no longer need to email the university, request a stamped letter or retain a complete copy of the certificate. The credential can be verified through the issuer's signature and the governance framework around it.

This does not make every claim true. Cryptography proves that a particular issuer signed particular data. Trust still depends on whether that issuer is legitimate, whether its process was sound and whether the verifier is legally entitled to request the information.

Standards maturity is not uniform compatibility

The idea of portable credentials is not new. Common data models and exchange protocols make it more practical to connect independent issuers, holders and verifiers, but they do not make every implementation universally compatible.

W3C published Verifiable Credentials Data Model 2.0 and Bitstring Status List 1.0 as Recommendations on 15 May 2025. The data model defines an issuer–holder–verifier ecosystem; it does not prescribe one wallet or exchange protocol. The status-list specification offers a compact mechanism for publishing status information such as suspension and revocation.

The OpenID Foundation published OpenID for Verifiable Presentations 1.0 as final on 9 July 2025 and OpenID for Verifiable Credential Issuance 1.0 on 16 September 2025. These define presentation and issuance flows. Shared formats, optional features and profiles still need agreement and testing.

Other components remain developing work. The 10 September 2026 Data Integrity BBS Cryptosuites draft is a Candidate Recommendation Draft, supporting selective disclosure and unlinkable derived proofs. The 22 August 2026 Verifiable Credential Barcodes draft is a Working Draft. Neither should be represented as a completed W3C Recommendation.

Selective disclosure needs the right claim

Most identity checks are still based on document disclosure.

To prove that a person is over 18, an organisation may ask for a national ID containing an exact date of birth, full name, identification number, photograph and other details. The organisation receives more information than the decision requires.

A selective-disclosure credential can reduce that exposure. The holder could disclose an issuer-provided age-threshold claim without revealing a birth date, or show a qualification without sharing a complete transcript. Selective disclosure, including BBS, does not itself compute “over 18” from a hidden birth date. That requires an appropriate claim from the issuer or a separately supported predicate-proof mechanism.

A professional might disclose that a licence is current without sharing unrelated records. A programme participant might prove eligibility without exposing a complete case file. These are possible designs, not automatic capabilities of every credential format.

This changes the privacy model. Institutions still need data-protection rules, security controls and accountable staff. But privacy is no longer based only on asking every recipient to store a full photocopy responsibly. The system can reduce the information disclosed in the first place.

Selective disclosure is not automatic. It depends on the credential format, proof mechanism, wallet, verifier and governance policy. A poorly designed presentation flow can still reveal a persistent identifier or combine attributes in a way that allows tracking. Privacy must be tested at the level of the whole transaction, not inferred from the name of the cryptographic standard.

Verification is not legal recognition

Foundational identification and portable credentials solve different problems. The World Bank's ID4D ownership indicator measures ID ownership among people aged 15 and older, not smartphone-wallet or online-ID adoption. Its 2024 observations are below 70 per cent in Sierra Leone, Guinea, Niger, the Republic of Congo, Mozambique, Tanzania, Togo and Uganda. These are foundational-ID figures, not evidence that those countries lack credential technology.

A sophisticated credential system does not help someone who cannot obtain a recognised source document. Equally, holding identification does not ensure that another institution recognises a qualification or licence. Trust, interoperability and legal recognition need distinct treatment.

Consider an illustrative nurse moving between two countries. A university could issue a qualification credential and a professional council a registration credential. The receiving regulator could check signed evidence against an agreed issuer list rather than reconstruct every claim through correspondence.

The receiving country still decides whether the qualification is equivalent and whether to grant permission to practise. Signature verification is not licence recognition or work entitlement. An agreement needs to specify recognised issuers, assurance requirements, status checks and a way to challenge an incorrect rejection.

Portable evidence can reduce repetitive verification work, but it must not conceal the judgement that remains with the institution. Faster checking of a claim and a fairer decision are related ambitions, not the same outcome.

Distributed governance does not require public personal data

Verifiable credentials are sometimes described as "blockchain identity." That label obscures more than it explains.

A credential does not need to place a person's information on a blockchain. Personal data should generally not be written to a permanent public ledger. Identity information changes, credentials expire, and people need ways to correct records and recover access. A permanent global trail of identity activity would create serious privacy and security risks.

A distributed ledger can play a narrower role when independent institutions need joint governance of an issuer registry, verification material or institutional accreditation record. Even status references need privacy analysis: publishing them carelessly can expose relationships or create persistent tracking.

The personal credential remains with the holder or in an authorised storage system.

Many national systems can meet their needs with public-key infrastructure and well-governed databases. A distributed ledger becomes more relevant when no single organisation should control the trust registry, such as a network involving universities, regulators and professional bodies from several countries.

The rule is simple: use a ledger when governance is genuinely distributed, not because blockchain makes the project sound modern.

Freshness and recovery are part of access

A credential system designed only for people with new smartphones, uninterrupted internet access and permanent phone numbers risks excluding legitimate users.

African implementations need several channels. A person may hold credentials in a mobile wallet, but programmes should also assess secure cards, printable QR codes, assisted service points and carefully governed cloud-recovery options.

Verification should tolerate intermittent connectivity where the risk permits it. MOSIP's Inji documentation describes issuance, wallet and verification components; documentation is a design reference, not independent certification of a local implementation. A signed QR protects its encoded payload, not the originality of the paper carrying it.

Offline signature checking cannot establish current revocation or presenter entitlement by itself. Cached status data needs an explicit freshness limit and synchronisation policy. A verifier must decide whether stale or unavailable status means acceptance, deferred checking or refusal, with an alternative service route where necessary. That decision should reflect the consequence of a false acceptance or rejection.

Recovery is part of the core architecture. People lose devices, forget credentials, change telephone numbers and use shared phones. A wallet with no safe recovery path can turn a security measure into a barrier. A recovery system that relies on weak questions or unrestricted administrators can create a different vulnerability.

Language, accessibility and digital literacy are also infrastructure requirements. Consent screens and data requests must make sense to the person using them. A technically valid presentation is not meaningful consent if the holder cannot understand what is being shared or refuse an excessive request.

Start with one credential and an accountable trust model

Technology can prove that an institution signed a credential. It cannot prove that the institution followed a fair process. A digitally signed exclusion decision can still be unjust, and an accurate credential can still be used discriminatorily.

Before procuring a system, settle who may issue each claim, how issuers are accredited, who can correct source records and how a person appeals. Plan for issuer closure, compromised keys and loss of a device. These decisions shape the trust model and recovery architecture; they are not administrative details to add after a wallet demonstration.

Start with one credential that is widely used and expensive to verify, such as a university qualification or professional licence. Connect a credible issuer, a holder-controlled presentation method and a small group of actual verifiers. Test another compatible implementation rather than assuming that shared standards guarantee substitution.

Measure verification time, information disclosed, rejection of legitimate users and recovery after device loss. Test weak connectivity and whether holders understand the request. The objective is to improve an institutional decision, not demonstrate cryptography.

Xelius approaches digital credentials as a trust and service-design challenge: map the claims that need verification, the authorities that can issue them and the governance required for interoperability. Organisations exploring this work can begin with one evidence exchange that is costly today.

The next generation of digital infrastructure should make it possible to prove what matters without exposing everything else.