discussion on trust anchors

[onthebreeze]

the readme says

As the demand (and price) for verifiable sustainable produce increases, so does the opportunity and attractiveness of fraudulent sustainability claims. A number of fraud opportunities exist - here's three;

• Fake material inputs. For example, a manufacturer creates a fake invoice from a reputable supplier to claim organic / carbon neutral inputs. Mitigation is to verify that the input was really sourced from the trusted supplier.
• Collaboration fraud. For example, a tanning plant bribes an inspector to issue a "real" chemical safety certificate without actually doing the inspection. Mitigation is to take evidence from tamper evident sensors where possible. Also to confirm that the the inspector is accredited by a trusted authority.

In the ideal world, all traceability claims would be digitally verifiable via cryptographic proofs and verifiable links to trust anchors such as national regulators.

This thread aims to provoke discussion about how to verify that claims are made by parties authorised to do so. Eg that an inspector issuing a certificate is accredited by the relevant accreditation authority or national regulator.

• do we need to define a list of trust anchors or can we assume that they are such well known domains (eg *.gov) that enumeration is not necessary?
• how to we encourage / help national business registers to issue VCs to business entity DIDs that can be used by the entity to cryptographically prove with identity?