Let’s talk about the identity your government is about to put in your phone — and the one question almost nobody is asking about it.
By the end of this year, every member state of the European Union is supposed to be able to hand its citizens a digital identity wallet. Not a pilot, not a nice-to-have. A legal obligation that came in with eIDAS 2.0 — Regulation 2024/1183 — and has been quietly rolling out all year while everyone was busy arguing about chatbots.
Here’s what it is, plainly. A wallet on your phone holding signed, verifiable credentials about you. Your date of birth. Your driving licence. Your degree. Your professional qualification. Your prescription. Your bank account. Issued by a government or an accredited body, checkable by anyone else in the union in seconds — no PDF emailed to a stranger, no folder under your arm in a queue.
That part is a real improvement, and I’ll say so.
Think about what it actually replaces.
A nurse trained in Portugal wants to work in a German hospital. Right now that means a folder: the diploma, a certified translation, an apostille, a registration certificate, weeks of correspondence, and a person at the other end who cannot verify any of it and knows it. With the wallet it’s one signed credential, shown once. Done.
Or take the boring version, which is the one that actually gets used. You’re twenty-three, you move country, and your first week is a wall of paper — SIM card, bank account, lease, registration. Every counter asks for the same three facts, and none of them trust the document the last one gave you.
So yes. Real, useful, unglamorous. I’ll take it.
Now look at the shape of the thing.
A wallet that can prove everything about you is, by construction, the most valuable single target in the system. Which is why the architecture document — the ARF — spends more of its pages on privacy than on function, and why the real fight inside it was never about features. It was about unlinkability. Whether the person checking your credential can talk to the person who issued it and confirm you were there. Whether five different services can compare notes and work out they’re all looking at the same human.
There’s a reason that argument was fought hard. Everyone can feel the failure mode. One app holding every claim about you, each claim issued by an authority that keeps its own record of you, all of it running on a rail built to work everywhere. That is not a wallet. That is a honeypot with a nice icon.
Then there’s the part that gets designed last and matters most: revocation.
Every credential has to be killable — the licence that got suspended, the qualification that was withdrawn, the age claim that stopped being true. Sounds responsible. Look at what it requires. The issuer has to be reachable. Which means the issuer can be asked. Which means, in a lot of implementations, the issuer can watch the credential being used. The fix is well understood — status lists and proofs that don’t phone home — but it’s more work than the naive build, and the naive build is always the one that ships.
So here’s what people are missing.
The real question isn’t whether a government wallet works. It will. The real question is whether it’s built as something you hold, or something held about you. Those two look identical on a screen and they are completely different underneath. One of them is a tool. The other is a leash with a serial number on it.
And there’s a second-order thing sitting behind that, which is the one I’d watch. The moment a signed credential becomes normal, the person who can’t produce one becomes the suspicious one. We’ve run that experiment before — with email, with cards, with passports. It never gets decided in a meeting. It falls out of the standard. Exactly the way age checks slid from “prove it if you’re asked” to “prove it to get in.”
So what’s the move.
If you’re building on this — identity, health, hiring, anything that touches a credential — build selective disclosure first, not last. Prove the fact, not the person. Over eighteen, not the birth date. Licensed, not the licence number. Then test the ugly one: who can see that this credential was used, and when, and where. If the answer is always the issuer, you haven’t built a privacy feature. You’ve built a reporting line.
If you’re just a person about to be handed one of these wallets, keep three questions ready. They’re the ones that separate a wallet from a file.
Can I choose what gets shared, per request — or is it all or nothing.
Can I see who asked, and can I prove later what I agreed to.
And can I take it off my phone and still live.
A wallet should be the thing you carry, not the thing that carries you. Identity has always been the most intimate infrastructure there is — the layer where being known and being watched stop looking different. A government-issued wallet isn’t automatically the enemy of that. It could be the opposite: the first time a person holds a real, portable, verifiable version of themselves that belongs to them, and not to whatever platform they happen to be standing on.
That’s worth building. It’s worth building properly, while the clock still runs.
And if it ends up a honeypot anyway, it will be because the easy version was cheaper — and somebody signed off on the easy version while nobody was watching.
You’ve got this.