This is a proposal on a small standard: a record shape for identity confidence — rank, score, type, issuer signature — anyone can write and any AppView can display and validate the same way.
My background is Digital Rights — I invented the first App Store, in 1993. I focus on human safety, harm reduction, and data sovereignty; I have four small children, this future isn’t abstract to me.
ATProto was designed with identity as a separate, portable thing — the DID stands apart and this is a tremendous opportunity to help secure our future world. That separation is critical to privacy, but the public lexicon is still the natural place to store the resulting measure of confidence.
In the same way an article is tamper-proofed, a pseudonymous post or account must be able to carry credibility — and a publisher must be able to validate it without ever holding PII.
An “informal protocol” would standardize this increasingly common requirement. Bluesky’s badge is on-protocol but authority-gated — hand-picked.
For everyone else, a signature inside the record, proving who issued it, checkable by anyone, forever, with no live callback, is possible based on what we’ve done a few times now.
What we built
When verify completes, we putRecord into the subject’s own repo at our NSID. The record is the result of validation, never the evidence.
{
"$type": "app.truanon.label",
"rank": "credible",
"score": "3",
"confidenceType": "social",
"verifiedAt": "2026-07-21T00:00:00Z"
}
Then the AppView getRecords it off the PDS. It travels with the DID and renders instantly like any other lexicon data - a lovely badge of trust.
A repo record is signed by the owner’s key. That’s gorgeous tamper evidence. Here, we have something where nothing stops writing { “rank”: “genuine”, “score”: “5” } by hand.
Where trust lives today is not complete
-
Issuer’s repo unspoofable, but only those who are hand-picked get to use it.
-
Labeler: unspoofable, graded if you like, but the claim lives with the service, not the account.
-
Subject’s repo (ours): travels with the DID — but self-signed, so unverifiable
Keep the record in the subject’s repo and embed the issuer’s signature inside it — a signature over the record’s fields, made with a key published in the issuer’s DID document. Any reader verifies offline, against the issuer’s key, forever, with no live service in the loop. This community already specified the primitive: community.lexicon.attestations.signature, as used in community.lexicon.badge.award.
{
"$type": "app.truanon.label",
"rank": "credible",
"score": "3",
"confidenceType": "social",
"verifiedAt": "2026-07-21T00:00:00Z"
}
Any verifier writes the same shape under its own key, and each AppView decides which issuer keys it trusts and at what threshold. The trust list stops being one company’s list; credibility thresholds become a per-community choice over one shared record shape.
The international regulatory and legal world really demands a variety of ever-evolving solutions and the results should be verified, protected and shared easily.
We’ve implemented the mechanism a few times over. What we want to close down, together, is the tamper loop — because everyone who touches identity confidence on this protocol will need to close it the same way.
I’d love your thoughts. Does subject-repo-plus-issuer-signature feel like the right corner to you, or would you place trust elsewhere? Any fields missing from the minimal set? And does a community NSID make more sense than ours for the published schema? Would you like to work on implementations people can use and adopt? I’m here to help.
.
the MVP/POC environment is at