Try our web3 digital twin for mail with your next message, just add **seal@vereign.com** to BCC of your next e-mail.

Unlock the power of Verifiable Credentials for your business thanks to Eclipse OCM & TSA, with [support](/services) from our team.

Georg Portrait

### What is the Web of Trust Map

Key State Capital's [Web of Trust Map](https://weboftrust.org/) provides a visual representation of the decentralized identity landscape. The map and its open-source dataset track global decentralized identity projects, including protocols and connections. It also highlights relationships such as industry collaborations and funding arrangements.

The map was developed by over 20 researchers and incorporates data on over 270 decentralized identity projects, 170 blockchains, and thousands of individuals and entities. By consolidating fragmented information, the Web of Trust Map promotes a broader understanding and acceptance of decentralized identity. This creates a comprehensive overview of key players and their interconnected ecosystems, closing the knowledge gap and making the information accessible to the public, researchers, investors, and regulators.

### About Vereign

Vereign is a pioneer in self-sovereign identity and digital authenticity, dedicated to enhancing trust in online interactions. By integrating privacy-first technology into existing digital workflows, Vereign ensures security, verifiable authenticity, and user control over digital identities. Their Web3 Digital Twins secure emails and documents with verifiable authenticity, while the Enterprise Identity Vault helps organizations manage verifiable credentials seamlessly. The Personal Identity Wallet empowers individuals to control their digital identities, ensuring security, privacy, and trust in online interactions. Through these innovations, Vereign is shaping a future where online interactions are both seamless and secure.

"Vereign's commitment to building the first internet-native identity layer aligns seamlessly with our mission to advance decentralized identity technologies. Their innovative solutions, along with our collaboration on the map, highlight our shared dedication to fostering a more transparent and trusted digital ecosystem.” said Nicholas Racz, Senior Partner at Key State Capital.

This collaboration strengthens the Web of Trust Map as a resource for navigating the decentralized identity ecosystem. By working alongside co-contributors such as Vereign, whose role is to verify data and provide feedback, the map becomes a more comprehensive tool for researchers, investors, policymakers, and the general public to gain deeper insights, foster informed decision-making, and drive innovation in the space.

### About Key State Capital

Key State Capital, an investment syndicate, specializes in investing in the development of responsible digital identity solutions with a focus on decentralized and verifiable systems for legal entities. As the sole angel syndicate in this domain, the firm's partners leverage their extensive technology background and deep understanding of digital identity to drive innovation. Their investment portfolio encompasses digital identity technologies, Zero Trust Protocols, verifiable artificial intelligence, cybersecurity, and secure communications. Additionally, Key State Capital has developed the Web of Trust Map and actively collaborates with businesses and international organizations to promote and implement secure digital identity and Zero Trust Protocol solutions.


Key State Capital's [Web of Trust Map](https://weboftrust.org/) provides a visual representation of the decentralized identity landscape. The map and its open-source dataset track global decentralized identity projects, including protocols and connections. It also highlights relationships such as industry collaborations and funding arrangements.


Screenshot from 2025-02-12 13-42-40.png

Mapping the Web of Trust: Vereign joining Key State Capital's Web of Trust Map

#### 31. August 2023
### Zug Switzerland & Kiel, Germany

Vereign has become the latest partner in the [Marispace-X](https://www.marispacex.com/) project, contributing its expertise in Self Sovereign Identity (SSI) to one of the premier [Gaia-X](https://gaia-x.eu/) lighthouses.

Marispace-X is working to create a digital maritime data space based on data sovereignty, security, interoperability and modularity of Gaia-X. Marine waters cover more than 70% of the surface of the Earth and account for more than 97% of Earth's water supply. Half the oxygen available to us has been produced by phytoplankton – every other breath comes from microscopic organisms in the ocean.

Making good decisions in this crucial ecosystem requires robust solutions, and Marispace-X has been using components developed by Vereign within the [Gaia-X Federation Services (GXFS)](https://www.gxfs.eu/de) for some time now. Our teams have been working together throughout multiple hackathons and on an ongoing basis.

![istock-1298836217-scaled.jpg](/uploads/istock_1298836217_scaled_02473bdda5.jpg)
![59836544_1006.webp](/uploads/59836544_1006_eb3f9e3352.webp)
![Nordsee-Ost-1024x384-1.webp](/uploads/Nordsee_Ost_1024x384_1_2819331685.webp)
![shmag97494_v-contentgross.avif](/uploads/shmag97494_v_contentgross_2c4a02e6c8.avif)

Initially developed under the GXFS umbrella, the GXFS components have joined the Eclipse foundation under the new name of [Cross Federation Services Components](https://projects.eclipse.org/projects/technology.xfsc) (XFSC). Within the XFSC, Vereign has been responsible for the development of, and keeps contributing to, the [Organizational Credential Manager (OCM)](https://gitlab.eclipse.org/eclipse/xfsc/ocm), [Trust Services (TSA)](https://gitlab.eclipse.org/eclipse/xfsc/tsa) and [Personal Credential Manager (PCM)](https://gitlab.eclipse.org/eclipse/xfsc/pcm).

Our team supports multiple Gaia-X data spaces in their adoption, and contributes to the various hackathons around Gaia-X, including for the recent [first place at the TechX](https://www.vereign.com/blog/events/1st-place-at-techx-hackathon-&id=31) Hackathon in Bilbao. This is the level of competency that Vereign now brings to Marispace-X directly.

"We're delighted to welcome Vereign as a Marispace-X Partner so they can directly contribute their deep expertise in Self-Sovereign Identity and Verifiable Data," says Jann Wendt, CEO of north.io and Founder of Marispace-X. "Over the past 12 months, our CTO has done a thorough analysis of different technical options and components. The competency and professional approach of Vereign really stood out for us - and made them the ideal candidate to join our team."

Concretely, we will work together on the Marispace-X wallet and integration with the Eclipse Dataspace Connector which we will coordinate our plans on during a dedicated session during the upcoming [GXFS Connect 2023](https://www.gxfs.eu/gxfs-connect-2023/) in Berlin. A joint hackathon is being considered for later this year at the Marispace-X headquarters in Kiel, Germany. If your technical team is also working on similar topics, please get in touch and join us during the upcoming workshops.

"Marispace-X is special to me because I've been born and spent the first years of my life on Heligoland where my father was a marine ecologist," says Georg Greve, Co-Founder and CEO of Vereign. "As a young boy I went out on the research vessels with him to help collect samples that turned into data points for his software models. So to me, the work we do with Marispace-X now really connects all the way back to my roots."

![Scientific Crew on Heincke, c.a. 1990](/uploads/photo_2023_08_29_13_27_46_b2c7f0dafc.jpg)
![Marine Research Vessel Heincke](/uploads/eb112136_0001_0004_0000_000000386225_w1600_r1_4916666666666667_fpx61_01_fpy55_01_710e20f054.jpg)
![Biologische Anstalt Helgoland](/uploads/2012_08_11_Heligoland_Ausflug_Boerteboote_03_3b828b8bbc.jpeg)
![Biologische Anstalt Helgoland](/uploads/Alfred_Wegner_Institut_Helgoland_June_2009_925f1e2317.jpg)

## Contact
### About Marispace-X
Marispace-X is a project funded by the German Federal Ministry of Economics and Climate Action in the context of Gaia-X. The aim is to build a maritime data ecosystem that allows stakeholders from business, science, public authorities and NGOs to securely manage, share and analyze data acquired about and from the ocean based on European standards and values, and to use this to gain new insights and develop new innovative solutions and services in the future.

By developing this digital ocean ecosystem, the project consortium addresses several key challenges of this decade, such as climate change, marine conservation and digital transformation through numerous practical use cases, including: Offshore Wind Energy, Biological Climate Protection, Munitions in the Ocean, and the Internet of Underwater Things.

The project consortium is led by the software developer [north.io GmbH](https://north.io/) and the cloud provider [IONOS SE](https://www.ionos.de/). Consortium partners in addition are the maritime big data expert [TrueOcean GmbH](https://trueocean.io/de/), the [Fraunhofer Institute for Computer Graphics Research (IGD)](https://www.igd.fraunhofer.de/), the [GEOMAR - Helmholtz Centre for Ocean Research](https://www.geomar.de/), [Stackable GmbH](https://www.stackable.de/) and [SubSea Europe GmbH](https://www.macartney.de/),  [Kiel University](https://www.uni-kiel.de/de/) and the [University of Rostock](https://www.uni-rostock.de/).  The involvement of numerous other international associated partners and maritime stakeholders ensures application-oriented development in all areas.

### About Vereign
Vereign AG (“Verifiable and Self-Sovereign”) is a sovereign technology company, in particular services and products around Self-Sovereign Identity (SSI). Founded 2017 in Switzerland, Vereign has been at the forefront of Self-Sovereign Identity based on principles of openness, privacy, and security. Vereign provides professional services, response times, and support for self-sovereign software solutions, such as the Gaia-X Federation Services (GXFS) organizational and personal wallets, the trust services API, or its digital twins for email and documents.

31. August 2023
**Zug, Switzerland & Kiel, Germany**

Marispace-X.jpg

Vereign joins Marispace-X

#### Brunswick, Germany
### 21 & 22 June 2023

Brunswick, Germany was last weeks' location for another exciting GXFS Tech Workshop. The event was packed with engaging presentations and dedicated Hackathon sessions that left attendees excited by the remarkable capabilities and functionalities of our SSI components within the Eclipse XFSC (Cross Federation Services Components), formerly known as Gaia-X Federation Services (GXFS) stack.

![workandfun.jpg](/uploads/workandfun_ac56531dcc.jpg)
![atwork.jpg](/uploads/atwork_3ffbd85777.jpg)
![party.jpg](/uploads/party_8dd349396a.jpg)
![kalin.jpg](/uploads/kalin_0aed295851.jpg)
![group.jpg](/uploads/group_75072cbfaa.jpg)

To make this edition of the [GXFS Tech Workshop series](https://www.gxfs.eu/de/events/) even more memorable, GXFS teamed up with the esteemed [German Aerospace Institute (DLR)](https://www.dlr.de/en) in Braunschweig. Not only did they graciously provide everyone with high-security facilities, but their warm hospitality also ensured that all participants felt right at home.

The event attracted an impressive array of stakeholders and projects, generating a calm and relaxed atmosphere of collaboration. Among the participants were [GAIA-X 4 AGEDA](http://www.gaiax4ageda.de/), [Marispace-X](https://www.marispacex.com/), [GAIA-Med](https://www.ifis.uni-luebeck.de/index.php?id=831) (University Lübeck), [Cosmic-X](https://www.cosmic-x.de/), [MERLOT](https://merlot-education.eu/), and [LEANEA](https://www.leanea.com/), to name just a few. Their presence added immense value and diversity to the discussions and activities throughout the workshop.

Undoubtedly, the highlight of the event was our hands-on session, where participants had the opportunity to set up our OCM (Organizational Credential Manager) in just one hour. Remarkably, the most time-consuming part was simply waiting for the code base to download. Our team was thrilled to witness the attendees' excitement as they experienced the enhanced usability and explored the world of digital credentials. This ease of setup and the subsequent sense of accomplishment left our on-site team, including Boyan Tsolov, Zdravko Iliev, Kalin Canov, and Felix Greve, beaming with pride.

The overall atmosphere of the workshop was one of joy and camaraderie. We had an absolute blast being part of this great event, and we're already counting down the days until we can reunite with this growing community once again. The future of SSI components and the potential for increased interoperability has never looked brighter, and we're excited to be at the forefront of this development.

## Did you miss it? No problem.

If you missed the event, and would like to re-live the experience of setting up the OCM for yourself, do not fret. Just **get in touch** and we will happily help you get started with our SSI implementation of the Eclipse Cross Federation Services Components.


group.jpg

GXFS Tech Workshop

#### Bilbao, Spain
### 3 & 4 May 2023

Last week Gaia-X organized the [#TechX Hackathon](https://gaia-x.eu/tech-x/) in Bilbao, Spain. [Maharshi Suchak](https://www.linkedin.com/in/maharshisuchak/) of[ smartSense Consulting Solutions](https://www.linkedin.com/company/smartsense-solutions/) took the unanimous first place for the popular vote and jury with his inspired presentation for several real life use cases in the automotive sector, built in great teamwork with [Boyan Tsolov and Lyuben Penkovski](https://www.vereign.com/about#team) of Vereign on top of the [SSI components](https://www.vereign.com/products/vault) of the [Gaia-X Federation Services (GXFS)](https://www.gxfs.eu/) stack.


![photo_2023-05-09_09-00-26.jpg](/uploads/photo_2023_05_09_09_00_26_7ca7d2d9e8.jpg)
![photo_2023-05-09_09-00-33.jpg](/uploads/photo_2023_05_09_09_00_33_a667849108.jpg)
![photo_2023-05-09_09-00-36.jpg](/uploads/photo_2023_05_09_09_00_36_735b92acfd.jpg)

**UPDATE 31.5.2023: Watch the live [presentation in Bilbao](https://www.youtube-nocookie.com/embed/a6d9go3aqnU)**

Just one week after the extremely [successful Hannover Messe 2023](https://www.vereign.com/blog/events/self-sovereign-identity-at-hannover-messe-2023&id=30), where German Vice Chancellor and Minister of Economy and Climate Action Robert Habeck visited the GXFS booth, four people of our team found themselves in Bilbao, Spain to provide [support to four different hackathon projects](https://gitlab.com/gaia-x/gaia-x-community/gx-hackathon/gx-hackathon-6/-/wikis/Proposals#17-implementing-verifiable-credentials-in-a-real-live-use-case) building on the SSI stack Vereign developed over the past 18 months. It has been a busy couple of days, with many interesting talks, and lots of knowledge sharing and discussion during an intensive hackathon. 


![photo_2023-05-09_09-00-19.jpg](/uploads/photo_2023_05_09_09_00_19_cb6732d635.jpg)


**All projects reached their goals, and we are optimistic that we will share some very concrete outcomes from some of these soon.**


This has proven once more that the GXFS stack is technologically robust, and the optimal choice to build upon for data spaces, and federations of data spaces, such as Gaia-X. Once the transition to the Eclipse Foundation is complete, the [Cross Federation Services Components (XFSC)](https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/472), as they will then be known, will be the basis for the first complete Community Open Source basis for data spaces, professional SSI use cases, and more. 

	

**To help get this community started, Vereign is happy to provide technical workshops of up to two days for organizations and companies to understand this SSI kernel for organizations.**


During these workshops we are glad to hold a concrete mini-hackathon together with your technical team where we integrate SSI into your use cases and systems. We will provide these workshops on a first-come, first-serve basis, subject to the capacity we earmarked for this.



So don’t wait and [get in touch today](https://www.vereign.com/services).


![photo_2023-05-09_09-00-44.jpg](/uploads/photo_2023_05_09_09_00_44_d58b3a1e68.jpg)

photo_2023-05-09_09-00-22.jpg

1st Place at #TechX Hackathon 🥇

#### Hanover
### 17th through 21st of April 2023

Switzerland-based digital identity provider, Vereign, has been overwhelmed by the great interest at the Hannover Messe 2023, one of the world's largest industrial fairs. Vereign's Self-Sovereign Identity (SSI) stack developed for the Gaia-X Federation Services (GXFS) received great interest as part of the GXFS booth at the Industry 4.0 stand of the German ministry of Economy and Climate Action.



The event, held in Hannover, Germany, witnessed the participation of over 130,000 visitors and 5,500 exhibitors, making it an ideal platform to demonstrate Vereign's Self-Sovereign Identity (SSI) stack which is scheduled to be merged into the Eclipse Foundation within the next couple of weeks.



![habeck.jpg](/uploads/habeck_a6fe6d2f17.jpg)



Vereign's innovative approach to digital identity management drew the attention of industry experts, government officials, and visitors alike. German Vice Chancellor and Minister of Economy and Climate Action, Robert Habeck, visited the Industry 4.0 booth at Hannover Messe and was updated by Andreas Weiss of the German Association of the Internet Industry on the progress made in GXFS.



GXFS, which is expected to serve as the foundation for many Industry 4.0 light houses, was one of the hot topics at the event. With Vereign being the key developer of the SSI components for GXFS, Vereign Co-Founders Georg Greve and Dr. Felix Greve found themselves at the center of many conversations about integrating Vereign Vault into various Gaia-X Lighthouses and Industry 4.0 initiatives.



Vereign's success at the Hannover Messe 2023 is a testament to the company's commitment to building secure, decentralized, and user-centric digital identities. As the world becomes increasingly digital, the need for robust identity management solutions will only grow. Vereign's innovative approach to SSI has positioned it as a leading player in the digital identity space, with a promising future ahead.



![stand.jpg](/uploads/stand_b6a3e2a84a.jpg)

Hannover Messe 2023 002.JPG

Self Sovereign Identity at Hannover Messe 2023

Vereign_Logo_ICON_BLACK.png

## Berlin
### 7. - 8. September 2022 

Dr. Felix Greve, our COO, was delighted to participate at the GXFS Connect 2022: Von der Idee zur
Innovation mit Gaia-X». This German speaking event took
place 7 and 8 September in Berlin.

Around 500 people were on-site or joined the livestream as the key actors behind Gaia-X gathered.
Among the speakers were high-ranking officials from the economy and government. It was extremely
encouraging for us at Vereign to see what innovations are made possible with the hard work we put into
key components for the overall SSI software stack. Also it was very satisfying to see that political
officials of the German Federal Ministry of Economic Affairs (BMWK) took it on themselves to attend
and appreciate the organization, use cases and the technology behind it.

![gxfs2022-2.jpg](/uploads/gxfs2022_2_f62803d66b.jpg)


Just weeks ago **we concluded the first implementation phase of the Organizational and Personal Credential Manager** just as well as the necessary Trust Services ([https://gitlab.com/gaia-x/data-infrastructure-federation-services](https://gitlab.com/gaia-x/data-infrastructure-federation-services)). These previously missing SSI key functionalities were highly anticipated and appreciated by the technical community. A special moment for us was when even the official representatives of the German ministry mentioned, they heard that the code quality is very good.

#### We strongly believe in data sovereignty, to see how our contributions are enabling the mission of GAIA-X in an actual real-world SSI ecosystem is at the core of our company values and goals.


![gxfs2022-3.jpg](/uploads/gxfs2022_3_3ede735601.jpg)


**For further information**:
- [https://www.gxfs.eu/follow-up-report-gxfs-connect-2022/](https://www.gxfs.eu/follow-up-report-gxfs-connect-2022/)
- [https://www.gxfs.eu/de/gxfs-connect-nukleus-fuer-europas-datenoekonomie/](https://www.gxfs.eu/de/gxfs-connect-nukleus-fuer-europas-datenoekonomie/)
- [https://www.gxfs.eu/de/rueckblick-gxfs-connect/](https://www.gxfs.eu/de/rueckblick-gxfs-connect/)


gxfs2022-3.jpg

Vereign @ GXFS Connect 2022

### On Tuesday, the 10th of December we held our second Ask Me Anything (AMA) in our Vereign Telegram group. The AMA was hosted by our Community Manager, Ivan Dzheferov, and the questions were answered by Pete Herzog, who is the co-founder of ISECOM and one of our advisors. Below we have put together an overview of the main questions for you: 

## Please could you introduce yourself briefly Pete Herzog?
I am the Managing Director of a security research nonprofit. I do OSSTMM, Hacker Highschool, advising, presenting, and a little go-go dancing - but I am not good at the last one.

## During 2019 data breaches are still a growing problem. What should individuals and organizations do to protect their online identities?

Eeeeep! They are a growing problem. But the problem comes from 2 places: we are getting less effective at cybersec despite more tools being available and better. Secondly, identity is a really really hard problem because it is so weak. The weakest of all aspects of security. And it leads to most other security controls breaking like authentication, non-repudiation, and even subjugation.

How do we improve it? Improve how identity is stored and shared so it is much more accurate. And secondly, train people in security analysis to make them more effective with the products that do work well.

## What would you say to the global issue of identity when it nation states take it upon themselves to dictate what the identity can be? Looking at China in this case.

The global governments have ALWAYS controlled identity. It is a social construct and controlled by social construct they ALL dictate it. China is just getting a bad rap over it because, you know, the dictatorship, oppressive government thing in our news.

Identity needs to go back to the people.

_**How could Vereign help in that direction?**_
Vereign is a federated network built on open protocols and open systems using an open database (blockchainy-ish) to keep records. It falls in our hands to conserve our identity and the people we share it with to propagate that trust in a p2p fashion, much like we do in real society. You are only you because of the people around you who know you IRL. That makes who you are. Not because a card says so.

_**Sort of how GPG/PGP's web of trust tried to do?**_
Similar but with more modern understanding of communication protocols and controls. 

## Can people manage identity, though? Governments are managing identity not simply because they can, but because they are a natural "stamp of existence". Is there an independent, trustworthy way to confirm that person X is indeed person X, and not person Z? You need a sufficient amount of witnesses to confirm person X is X, but then these witnesses also need to be trusted. And in the end if you go to a bank that doesn't know you, or to request a driving license, will the bank rely on a) the word of a few strangers it doesn't know b) the stamp of a government.

We have to because the Government sucks at it. If they did not commit fraud it would not be the LARGEST problem we have. We cannot have centralized identity because we cannot have centralized trust. That is the biggest weakness in identity today. Your folks did not commit fraud when they named you. But you could still do so in reporting who you are to government census/offices.

The government identity thing only works for the people who think it works. For the rest there is corruption, fraud, black money, and a whole host of other unsolvable problems without better identification.

## In a world of synthetic identities, impersonation attacks, deep fake voice and video, how do we know who is real online?

Currently, we cannot easily. We like to trust that most is and most people are nice but that just is not really something proven. Actually, at this point there is no reason to just have your IRL identity online. I recommend you fracture it as much as possible and be many selves in many online places so that you cannot be centrally tracked and doxxed. At least until we have a valid identity system in place and non-repudiation can hold people accountable.

## Are digital identity and data breaches so intertwined, or are they separate problems? You can do a SQL injection to extract incorrectly stored credits cards without breaching someone's identity, government managed or not. And should not we solve the two problems separately.

Do not get me wrong, identity is not the solution to all problems nor is it the cause. Identity is just one of 12 necessary controls we know of and an integral part in at least half of all controls. So solving any one problem does bring us closer to solving others.

_Vereign_: Government identities are at the basis of a lot of the services we use necessary for modern day society to function. Identity checks are still necessary for some transactions, but in your private and professional life you only need to be sure you are talking to the same person or organization you have built trust with over time. We do add an aggregation of validations from trusted 3rd parties which can be reused across applications to verify details or aspects of the other side you are talking to to strengthen that trust.

What mechanisms are there (perhaps to be developed) to manage a 3rd party that goes rogue. Or is compromised in a manner that now is essentially sabotaging the system and perhaps bringing down the portion of the "web of trust". Since we can anticipate that, is there some thinking on how to address it?

_Vereign_: We currently have notifications and a tamper-proof audit log. You can see when someone is trying to misuse the functionality.

_Pete_: The best part of the audit logs is so that everyone else can see that we're not centrally capable of tampering with anything.

A 3rd party rogue happens all the time in the current system. We cannot address that if we do not have a federated system. With a central system it's impossible to manage or address in a timely manner. In a federated system it would be immediately rejected or marked as untrustworthy.

_**Interesting. It is not a byzantine general problem problem?**_
Kind of. The world is a trustless system and to be honest, I am not sure how much of it we can make trustworthy. I envision that, like in a real-world scenario, there will be huge swaths of untrustworthy identities who are trustworthy between each other but nobody else. We will not know until we grow the system.

Do you have more technical information on that (the tamper proof log)? E.g. is it using merkle proofs?
_Vereign_: You can read more about it in our White Paper "4. The Technical Solution"

## Speaking about identity: There is a saying “Nobody cares about backup, people only care about restore”. How do we secure our restoration mechanisms? They are a usual attack vector to all online identity systems.

That is a tough problem that requires maintaining the integrity of the stored data and the restored data while knowing if the data being replaced is legit newer data or garbage. There are so many kinds of attacks that restoration depends on intent— why are you doing this? We cannot secure it all so knowing the value of something, why is it there, allows us to apply specific controls and therefore actually have a shot of doing it well.

_**How does Vereign manage the restore?**_
_Vereign_: We use a "Social Recovery" mechanism. There are two or more trusted people from your verified live address book you can select to help you restore your access. Also there is a preventive mechanism for misuse of that functionality. There are also more features planned in the pipeline. It's not an easy thing to solve and there are not perfect solutions so far.

And what is that thing that you use to prove that you are you? A private key? How is it stored?
Pete: Part of the problem is that identity is both a human and physical thing that we need to tie to a "cyber" presence. For a lot of what needs to be done, globally the technology and the know-how is in its infancy.

_Vereign_: That is correct. It's stored on one or more devices you manage and protected with a second factor. Currently a PIN.

_**Isn't that hard from a usability perspective? People barely manage passwords.**_
_Vereign_: Keys are hard to manage, but in our case you do not really see them.

## One of the great improvements, but lately single point of risk on the internet are certificate authorities: How are they usually protected from attacks?

CAs have authority to sign on your behalf even backwards in time. Although secured to the best technological and organizational measures possible. 

_**You were part of co-creating an innovation with us on how to secure your signature, so only you can sign. Could you tell us more about it Pete Herzog?**_

Most commonly these are protected by authentication controls which are really weak. Sure, they layer the hell out of them but a broken identity will get through all layers at once. Which is generally how they're broken. In the last few years more is being done to add a physical layer and storing the keys physically away from the network in parts so that getting them requires the time to retrieve all the pieces and put them back together. That is actually a pretty sweet, innovative trick for protection.

First, they do not use the best security. It's not viable to do so neither monetary nor practically. Since CAs use a central trust, they can do whatever they want and clean up the logs. Good luck proving it was not you. Now you might think, why would they care to do that to me? Sure, you could think that. But there is a huge difference between risk and trust. They are selling trust but you are buying risk. That is the problem. Trust is what you have when you accept risk. You should not have to accept that much risk.

## In one of your initiatives “Hacker HighSchool” Pete, you teach kids cybersecurity skills and awareness. What are the top three things they learn applicable to us as adults?

Hackerhighschool.org was developed to teach teens to think for themselves. Hackers do that really well. They look things up they do not understand. They dig deeper. By understanding things you also see new perspectives. So the three things are: resourcefulness, empathy, and critical thinking. Probably not what you were thinking but really cyber safety and cybersecurity are a byproduct of those things. And the important fourth thing is the ability to learn from your failures. Perfect mix for any school child.

Vereign is also a community effort and we would appreciate your participation in our [Community](https://community.vereign.com/).

On Tuesday, the 10th of December we held our second Ask Me Anything (AMA) in our Vereign Telegram group. 

4402-Social-support-AMA-OG-1200x675-1-790x380.jpg

Ask Me Anything: with Pete Herzog Recap

georg-300x300.jpg

### On Thursday, the 6th of June we held our first Ask Me Anything (AMA) in our Vereign Telegram group. The AMA was hosted by our Community Manager, Ivan Dzheferov, and the questions were answered by one of our Co-Founders, Georg Greve, who is also the Chairman & Head of Product Development.

Below we have put together an overview of the main questions for you:

## When should we expect integration with Microsoft 365 and outlook?

We are slightly dependent on Microsoft in this because we would like to offer this as a supported option for existing Microsoft customers, such as the Canton of Zug, which wants to use Vereign. We have a contact at Microsoft who is currently finding the right people to work with on their end to make this happen in cooperation. Integration is not difficult. It only took Collabora a few days for LibreOffice. My guess would be sometime in Q3.

## Why did you first try to solve digital identity for email?
Digital identity is difficult. There are interesting pieces and approaches out there, but they often have a high failure rate. It boils down to an identity you cannot use for anything being quite useless. That sounds tautological but it seems to have escaped many people. We were looking for the most valuable use cases for a third party verified, self-sovereign identity with zero touch key management. Email was a clear winner: it was the only truly federated communication protocol out there. It is not dependant on a single company or group, there are multiple implementations, it is censorship resistant and much more.

Email is used by four billion people. Ninety-five percent of businesses depend on email as their primary means of communication. According to forrester, last year, more teenagers had email accounts than Facebook. This makes sense because email is the root identity for many other online identities by virtue of being used for password recovery. Therefore email is at the heart of most online identities. It is the world’s largest unverified identity database. That lack of verification brings some challenges, though. Business Email Compromise, invoicing fraud & co are at an all time high – and growing.

## Right now only email and phone can be validated in your beta app… How exactly are you going to verify other data in the live version, such as name, address, etc.?

We will be doing this via third parties as there is no “one size fits all” that would work globally. So you will be able to use your Zuglogin (the eID of the Canton of Zug), your SwissID, your RFID passport, or any other third party that can offer such verification and assurance levels. We are for instance already looking at the practicalities of integrating this with Yapeal.ch, a very cool challenger bank from Zurich. They have a great onboarding via mobile app. So you can start your onboarding via Vereign login with selective data disclosure to pre-fill the forms. You then receive the returned verified data into your Vereign identity.

_**What about other countries that don’t have access to this type of services? I assume you’ll be using KYC providers such as Onfido/Jumio?**_
Yes, we are agnostic in this because every country and culture may have its own ideas about how to approach this.

_**Will any of the scanned documents that users provide for this type of verification be retained somewhere?**_
That will in part depend on the verification provider. You could for instance even use existing functions, like a notary, to do higher level verifications. I believe they would usually keep a paper copy in their safe. Other 3rd party onboarding providers might also store such data for a limited time (GDPR applies, obviously) as part of the regulatory requirements the government has placed upon them. As for our solution: users will of course be able to retain a scan of their ID card or other document (potentially with verification) in their personal storage as that may be very useful.

_**Hmm, regulatory requirements would apply if the verification was being done by a regulated business, such as a financial services provider. They shouldn’t be required to keep the documents under any regulation as the verification is not done for a particular purpose… However, if using the Vereign identity for regulatory purposes is a potential use case, some framework for that needs to be put in place.. and negotiated with regulators I guess.**_

Yes, exactly. Banking is a very real use case for what we’re building. A lot of banks would love to be able to communicate with their customers over email. Because right now they are usually sending messages in online banking. Which most customers happily ignore as the message counter goes higher and higher. So the account managers have started sending text messages to the customers “please look at your online banking messages, I’ve left you something important.” Both customers and banks hate that currently approach.

Side note: It is even more complicated. You have two laws competing. One about retaining business records. The other one about deleting data as soon as possible as part of data protection. We’ve been looking at this in some detail – one of the perks of having a CISO of the world’s no 1 logistics company among the founders – but of course this won’t all be implemented in the Minimum (!) Lovable Product.

## What is the chance of digital identity to go deeper in real life and maybe replace the current monolithic ‘hardware’ ID cards?

That may happen at some point. In a way Vereign will make these hardware tokens (a.k.a. passports) portable in a sense, but knowing the speed at which politics moves, I think that may take a while to become “official”. This is not a terrible thing because there is a huge area for which “inofficial, but robust” is “good enough”. Just like you do not really need qualified electronic signature all the time. An advanced electronic signature with a solid identity grounding will be extremely useful already – and cover 90% of the cases.

## Why do you coin Vereign as a new service category? Why has nobody built something like this?
At this point, there are fragmented identities that are owned by the companies that provide them to us. Vereign puts user-data and control into the hands of the people. It is a useful, verified identity that allows users to take control of their identity in a way that you can take authentication and selective data disclosure toward third party services. If you combine that with the zero touch key management that creates one-time keys for every interaction, and you have a kind of function that has not existed before, which is why it is so hard to find a name for this. The true power becomes apparent once you realise this seamlessly integrates into any existing application or service. Peer-to-peer interactions create live connections between people – on equitable terms that are determined by the people as they connect, which creates a sort of “social fabric”. The first steps of that will be a magically, self-updating, verified address book of all the people and organisations you are interacting with, but a lot more will be possible on this basis. As to why nobody has built this yet… We have not had all the ingredients in the past. Things become more obvious only after someone has done them first.

## We would appreciate if you have any further questions to get in touch with us and also be part of one of the next sessions. Also, please feel free to join us on [Telegram](https://t.me/vereign) or in our [Community](https://community.vereign.com/) and ask questions.



On Thursday, the 6th of June we held our first Ask Me Anything (AMA) in our Vereign Telegram group. 