DID · In development
DID is Resolving Architecture's decentralized identity work: a key you control, a web of trust built from signed vouches instead of a certificate authority, and social recovery so losing a device doesn't mean losing the identity. It runs today as the identity layer for 1M5.
The direction has changed. Rather than build another identity system — the thing OpenPGP and W3C DIDs both tried, and both saw ignored — DID now targets the two gaps in Nostr, the one decentralized identity network that is actually growing: key recovery and real attestations. The deliverable is a short specification and a small MIT-licensed library, not a platform.
Why the direction changed
OpenPGP had impeccable cryptography and thirty years. It lost because it made identity the product, made key management the user's job, and asked for a web-of-trust ceremony with no payoff. It was always bolt-on, never a default.
W3C DIDs had a decade and a large standards apparatus. They lost on strategy rather than engineering: specifications written years ahead of demand, over a hundred registered methods that don't interoperate in practice, and complexity stacked at the wrong layer. The largest deployments of that technology are now being built by states.
Nostr is the first thing in this space that has actually moved. The key is the identity — no document, no registry, no resolution step, no method to choose. It shipped a social app first and handed people an identity as a side effect, and its specs are small enough to implement in an afternoon. What it still lacks is exactly what becomes visible at the worst possible moment.
The strategy
A single architect cannot win a standards war or a consumer-app war — both are capital-and-headcount games. But one person can own one small, load-bearing, missing piece of a network that already has users, and let other people's applications do the distribution.
One secp256k1 key with three names: raw hex internally, an npub for people, a did:nostr for interoperability. No Resolving Architecture DID method — did:nostr already exists as a community draft, and RA contributes to that rather than registering another one.
Guardian-based social recovery and key rotation as signed events. You name a few guardians — contacts, or your own second device — and a threshold. When enough of them co-sign, your identity and social graph move to a new key. No shard custody, no server, no relay changes.
Nostr's common verification, NIP-05, means a DNS domain vouches for a key — a registrar and a certificate authority sitting in the trust path. The replacement: N people you already trust vouch for this key. Nothing to seize or compel.
Tiny, MIT-licensed reference implementations with shared test vectors, so a second implementer can prove compatibility without talking to us. TypeScript first, where the Nostr client developers actually work; Rust and Java follow for RA's own stack.
Why now
Under eIDAS 2.0, every EU member state must offer a digital identity wallet by the end of 2026, and within a year banks, telecoms, and large platforms must accept it. Other jurisdictions are moving on age verification and digital ID on similar timelines. "Digital identity" becomes a mainstream conversation for hundreds of millions of people — and a meaningful fraction of them will be uneasy about it.
The argument is on the merits, not on alarm: here is a system with the same properties a state wallet promises — selective disclosure, user control — that additionally cannot be revoked by whoever issued it, because nobody issued it. You already have an identity: a key you hold, and people who vouch for you.
Proven in use
DID isn't a whiteboard design. The service that runs today is the Java implementation, built on OpenPGP key rings, handling node and account identities, key management, and signing for 1M5 — a communications system built to work under denied and degraded network conditions. That's where the design gets its requirements and its pressure-testing.
The move onto Nostr primitives is additive and gradual. Existing identities migrate with a signed proof binding the old key to the new one; no user loses an identity.
The technical shape
An identity becomes one secp256k1 keypair with BIP-340 Schnorr signatures — no key ring, no master/subkey structure, no certificate. Every record — an attestation, a guardian set, a rotation — is a standard Nostr event, verifiable by software that has never heard of Resolving Architecture, against a shared file of test vectors.
W3C DID interoperability is kept as a thin did:nostr compatibility view over a key RA already holds — and explicitly nothing more. No JSON-LD, no Verifiable Credentials, no DIDComm; that is where DID adoption went to die.
Relays are one distribution option, not the architecture. The signed records are transport-agnostic and travel over any 1M5 route; publishing them to public Nostr relays is one opt-in choice among several.
Anti-impersonation is the part that drives adoption. "Three people you trust vouch for this account, and one has flagged it" is an anti-scam feature people feel the need for daily — which is what gives the trust layer a reason to be adopted by people who don't care about self-sovereign identity as a philosophy. The mission and the product benefit are the same feature.
Where it stands
The plan, ordered cheapest and highest-leverage first, so the work produces something useful even if it stalls:
If you're building on decentralized identity, or want to compare notes on the move from OpenPGP to Nostr-era primitives, get in touch →
Origin
DID started as the identity and key-management service that 1M5 needed and couldn't borrow from anywhere central. Building it against that requirement — identity that keeps working when services, network paths, and issuers can't be trusted — is what shapes the design, and what pushed it toward riding a network that already exists rather than standing up another one.