Draft:Trust Registry

• Comment: Thank you for making an effort to write a relatively neutral and factual article. The majority of the citations in this draft are to primary sources (WP:PRIMARY), which are not sufficient to show notability (WP:SIRS).
  Also, can you please disclose whether you used a generative AI tool to help write this article (see WP:NOLLM)? And do you have any relevant conflicts of interest (WP:COI)? Thank you. Dreamyshade (talk) 14:39, 25 July 2026 (UTC)

---

A trust registry (also called a trust list) is a repository that serves as an authoritative source of statements about a trust community, in particular which entities are authorized to perform which actions within a governed digital ecosystem, such as issuing or verifying a given type of digital credential. Trust registries are a core building block of decentralized identity architectures based on verifiable credentials, where they allow a relying party to determine not merely who issued a credential, but whether that issuer is recognized as authoritative for that kind of credential under the rules of an ecosystem.

In the model of the Trust Over IP Foundation (ToIP), a trust registry is the network service through which the governing authority of an ecosystem governance framework specifies what governed parties are authorized to perform what actions. A trust registry does not itself create authority: the authority of a registry is an outcome of governance, and the registry is simply the queryable expression of it.

Background

Verifiable credential systems are commonly described as a "trust triangle" between an issuer, a holder, and a verifier. Cryptographic verification lets a verifier confirm that a credential has not been tampered with and that it was signed by a particular issuer, but cryptography alone cannot answer the question that follows: is this issuer actually entitled to make this claim? A diploma signed by an unknown key proves nothing about whether the signer is a recognized university. This "issuer trust" gap is the problem trust registries address: they bind cryptographic identifiers (such as X.509 certificates or decentralized identifiers) to accreditations granted under a published governance framework, so that verifiers can check an issuer's status at verification time.

The same mechanism can operate in the other direction: registries can also list accredited verifiers, allowing a credential holder (or their wallet) to check whether a party requesting a credential presentation is authorized to ask for it. The mechanism can further extend to other ecosystem roles, such as accreditation bodies that grant issuing or verifying rights to others.

History

Trust lists before decentralized identity

Authoritative lists of trusted parties long predate verifiable credentials. Web browsers and operating systems ship root-certificate programs that determine which certification authorities are trusted, and document software vendors maintain equivalent lists for electronic signatures. The most formalized example is the European Union's trusted lists: Article 22 of the eIDAS Regulation (No 910/2014) obliges each member state to establish, maintain, and publish a trusted list of the qualified trust service providers under its supervision, in a standardized XML format (ETSI TS 119 612); the European Commission aggregates these into a "List of Trusted Lists" (LOTL). A trust service provider is legally qualified only if it appears on a trusted list. Under the eIDAS 2.0 framework and the European Digital Identity (EUDI) Wallet's Architecture and Reference Framework, trusted lists are extended to hold the trust anchors for wallet providers and credential issuers.

Trust registries in decentralized identity

As self-sovereign identity architectures matured, the need for a standardized, machine-queryable registry layer became explicit. The Trust Over IP Foundation, a Linux Foundation project launched in 2020, placed the trust registry role in the governance layer of its four-layer stack, and its Trust Registry Task Force published a first Trust Registry Protocol specification (v1) in 2022. The topic was also explored in community research, including the Rebooting the Web of Trust workshop paper "Verifiable Issuers and Verifiers" (2022), which catalogued approaches for communicating lists of trusted issuers and verifiers.

The task force's work led to the Trust Registry Query Protocol (TRQP), a substantially redesigned second version. ToIP announced its implementers draft in April 2024, and TRQP v2.0 was subsequently ratified as a ToIP Approved Deliverable.

Trust Registry Query Protocol

TRQP is a lightweight, read-only protocol for querying authoritative data from trust registries, described by ToIP as being "to trust registries what DNS is to name servers." It deliberately standardizes only the query interface, not how a registry is governed, stored, or replicated, so that heterogeneous registries (government trusted lists, blockchain-based registries, federation servers) can answer the same questions in an interoperable way. The protocol defines two core query types:

• Authorization: asks "Has Authority A authorized Entity B to take Action X on Resource Y?" It is used, for example, to ask whether a DID is an accredited issuer or accredited verifier for a particular credential schema of a given ecosystem.
• Recognition: asks "Does Authority X recognize Authority B as authoritative for Action X on Resource Y?" It is used between authorities, allowing one ecosystem or registry to acknowledge another, which enables federation and "registry of registries" topologies.

TRQP is registry-agnostic and transport-agnostic (an HTTPS binding is defined, with others possible), and its design anticipates bridges to adjacent trust frameworks such as OpenID Federation, X.509 chains, and TRAIN.

Implementations and related systems

Several systems implement the trust-registry function with differing architectures, and interoperability between them is an active area of work:

• EU trusted lists (eIDAS): the supervisory model described above, with national, government-operated lists aggregated by the European Commission, carrying legal effect within the EU.
• EBSI Trusted Issuers Registry: the European Blockchain Services Infrastructure maintains a decentralized registry recording trusted issuers, their public data, and accreditations for cross-border public services.
• OpenID Federation: an extension of the OpenID family of standards that expresses trust through chains of signed "entity statements" resolved between federation participants, rather than through a central list.
• TRAIN: a trust-management infrastructure developed by Fraunhofer, anchoring discoverable trust lists in the DNS.
• Verifiable Public Registry (VPR): a public, blockchain-based "registry of registries" in which each ecosystem entry plays the trust-registry role, recording credential schemas and the participants authorized to issue or verify against them; it is queried during the trust-resolution process of the Verifiable Trust model and exposes a profile of TRQP v2.

A 2024 Fraunhofer analysis compared four of these approaches (TRQP, the EBSI trust model, OpenID Federation, and TRAIN), identifying gaps in interoperability, governance, and validation, and proposing a "universal resolver" across trust registries.

See also

• Verifiable credentials
• Decentralized identifier
• Self-sovereign identity
• eIDAS
• Public key infrastructure
• Trust anchor
• Trust service provider