INTERNATIONAL MACHINE PASSPORTS: A GLOBAL TRUST LAYER WITHOUT A SINGLE GLOBAL IDENTITY AUTHORITY

Full report

On this page

Executive Summary

As autonomous agents transition from experimental digital systems to primary economic actors, the global economy faces a critical structural bottleneck: the crisis of machine identity. Software agents, powered by advanced artificial intelligence and distributed ledger networks, now possess the capability to negotiate, purchase, and execute complex commercial contracts autonomously. Yet, the mechanisms for verifying the legal, financial, and operational backing of these non-human entities remain fundamentally fragmented. The current absence of standardized, globally recognized machine identification introduces catastrophic counterparty risk to digital transactions, severely throttling the potential of the autonomous economy. This comprehensive report provides an architectural and standard-based blueprint for International Machine Passports (IMPs), establishing a global trust layer that definitively rejects the reliance on a single global identity authority. Instead, it positions machine identity as a federated, multi-jurisdictional ecosystem. By explicitly decoupling cryptographic verification from legal, political, and operational trust decisions, this architecture allows entities across diverse jurisdictions—ranging from corporate enterprise networks to sovereign national governments and autonomous economic zones—to interact seamlessly without sacrificing regulatory sovereignty or suffering from identity colonialism. Through the integration of decentralized standards such as W3C Verifiable Credentials (VCs), Decentralized Identifiers (DIDs), Selective Disclosure JWTs (SD-JWTs), and hardware-level remote attestation, this framework transforms unquantifiable risks into predictable, insurable, and accountable transactions. Furthermore, this report addresses the realities of a post-quantum cryptographic future, navigating the transition from classical elliptic curves to lattice-based signatures, while natively integrating with emerging and aggressive regulatory regimes governing digital assets, smart contract enforceability, and biometric privacy. The resulting infrastructure establishes machine identity as a neutral, international utility, creating a permanent economic competitive advantage for early-adopting jurisdictions that build the rails for the automated global marketplace.

1. Architectural Principles of Federated Machine Identity

To scale globally and resiliently, an International Machine Passport system must fundamentally reject the paradigm of a centralized global identity root. A monoculture of identity is both a geopolitical impossibility—as sovereign nations and independent economic zones will not cede credentialing authority to a foreign superpower or a singular corporate entity—and a systemic cybersecurity single point of failure. Instead, the IMP architecture is built on federated machine identity and a zero-trust verification paradigm adapted explicitly for machine-to-machine (M2M) commerce. In a federated machine identity architecture, no single organization, government, or technology provider acts as the sole root of trust1. The concept of Decentralized Identifiers (DIDs) shifts the paradigm by providing user-generated, self-owned, globally unique identifiers that are rooted in decentralized trust systems rather than centralized domain registries or certificate authorities1. Identity is thereby distributed across a vast, interoperable web of diverse issuers, including corporate registries, government departments, professional testing bodies, insurance consortia, and hardware manufacturers. These entities operate across varying jurisdictions, where different nations maintain their own distinct legal definitions of algorithmic capability, corporate registration, and qualification. Rather than querying a central registry to check if an agent is valid, relying parties verify the cryptographic lineage of credentials directly and evaluate them against local, context-specific policies4. A core design tenet of the federated IMP model is the absolute separation of credential issuance from trust policy acceptance. In traditional identity systems, issuance and acceptance are tightly coupled; an entity issued a credential from an unrecognized authority is entirely excluded from the network. In the IMP model, an issuer simply asserts a set of factual claims about an agent—for instance, asserting that an agent is authorized to commit up to specific financial limits on behalf of a parent corporation—and cryptographically signs this claim using their unique DID1. The relying party receiving this claim determines whether they trust the issuer for this specific transaction. A corporate entity in one jurisdiction may accept a foreign-issued authorization claim for software procurement but reject it for the acquisition of real estate, based entirely on their internal risk tolerance and compliance mandates. This decoupling allows autonomous agents to conduct commerce worldwide. They do not need foreign governments to diplomatically recognize their host jurisdiction; they only require private counterparties to mathematically verify and commercially accept their operational credentials.

2. Separating the Five Dimensions of Verification

A common failure mode in digital identity design is the collapse of multiple distinct verification questions into a single binary validation check. When applied to machines, this binary approach fails to capture the nuances of cross-border commerce. To support robust M2M transactions, the IMP system explicitly separates verification into five distinct analytical layers. This approach represents an evolution beyond standard Zero Trust Architecture (ZTA). While standard frameworks like NIST SP 800-207 rely heavily on continuous identity verification and least-privilege access before granting entry to a network, they often assume a singular enterprise perimeter or a unified Identity Provider6. The IMP model extends ZTA into a multi-jurisdictional reality by utilizing an Executable Trust Architecture (ETA), which recognizes that real-world interactions consist of sequences of dependent steps where inconsistencies may arise even when each step is locally valid8. ETA formalizes trust as a sequence-aware property defined over trust evidence objects, distinguishing baseline step-level verification from broader interaction-level trust8.

Under the ETA framework, trust is evaluated across the execution sequence using strict conditions. The system first evaluates baseline validity by ensuring signature verification, schema compliance, and selective-disclosure hash checks are accurate8. It then evaluates constraint enforcement to ensure that the disclosed claims fall strictly within the user's consent scope and the transaction's required scope8. Furthermore, it evaluates sequential cryptographic linkage and cross-step state consistency to prevent replay attacks and time-of-check to time-of-use (TOCTOU) vulnerabilities8. By treating these dimensions as independent vectors rather than a single boolean condition, the IMP architecture allows relying parties to construct highly granular trust policies tailored to specific transactional risks.

3. Resolving Semantic Ambiguity: The Status of Unknown Agents

In centralized identity architectures, any entity or issuer not explicitly on an approved list is treated as fraudulent or blocked outright. In a dynamic, global machine economy, this binary approach causes severe economic friction. It leads to false positives, systemic discrimination against emerging jurisdictions, and the exclusion of innovative autonomous agents. The IMP system introduces a nuanced, multi-state evaluation framework for handling unfamiliar issuers and agents, ensuring that ambiguity is resolved programmatically rather than resulting in an immediate network block. When evaluating a credential, the verification engine may encounter an "Unresolved" state, where it cannot reach the issuer's registry or revocation status oracle due to a temporary network timeout or routing failure. In this scenario, the credential is kept in a pending state rather than being flagged as inherently fraudulent. Alternatively, the system may register an "Unsupported Issuer" state. Here, the issuer's signature is cryptographically valid, but the relying party does not have a mapped trust relationship with this specific registry or authority. If the agent's identity is valid but the presented credentials do not meet the minimum threshold of claims required by the relying party's trust policy for the current transaction value, the system registers "Insufficient Evidence." To prevent a total breakdown of commerce, the IMP system introduces the concept of "Conditionally Accepted" transactions. An agent may be granted restricted, low-privilege access, such as limited API rate limits, sandbox execution, or escrow-backed payment terms, simply because its credentials are mathematically sound but originate from an unfamiliar jurisdiction representing an unquantified but non-malicious risk profile. If the risk is deemed too high, the agent is "Denied for This Purpose," blocking it from completing the requested high-value transaction, though its passport is not blacklisted, leaving it free to attempt low-risk transactions elsewhere. The system reserves the "Fraudulent" designation solely for clear, provable cryptographic failures, such as tampered signatures, cloned credentials, or known malicious actors flagged by anti-money laundering databases. By adopting these granular semantic states, the global trust layer avoids blackholing agents from developing economic zones. If a newly registered autonomous agent initiates contact with a conservative financial institution, the institution's system does not instantly classify the unknown agent as a cyber-threat. Instead, it classifies the interaction as an unsupported issuer lacking sufficient evidence. The systems can then programmatically negotiate risk-mitigation terms, shifting the security paradigm from binary exclusion to dynamic risk mitigation.

4. Evaluation of Technical Standards and Post-Quantum Cryptography

A robust machine passport system must be built on open, battle-tested, and future-proof standards. The selection of these standards dictates the scalability, privacy, and security of the entire ecosystem.

Core Protocol Standards

The identity layer of the IMP is governed by the W3C Verifiable Credentials Data Model and the Decentralized Identifiers specification4. DIDs enable an entity to prove control over an identifier by authenticating using cryptographic proofs without requiring permission from a central authority1. VCs serve as the standard wrapper for all machine passport claims. Because the W3C model supports JSON-LD and Linked Data semantics, a verifying system in one jurisdiction can seamlessly interpret the semantic meaning of fields issued by a registry in another4. OpenID for Verifiable Presentations (OID4VP) is utilized as the core transport layer when an agent presents its machine passport to an enterprise API gateway, operating smoothly over standard HTTPS and REST APIs9.

Selective Disclosure Payloads (SD-JWT VC)

For the payload format, Selective Disclosure JWTs (SD-JWT) as defined by IETF RFC 9901 and profiled by the draft-ietf-oauth-sd-jwt-vc specification form the critical privacy layer14. SD-JWT VCs allow an agent to reveal only a specific subset of claims contained in a token, rather than disclosing the entire payload, which is essential for data minimization and privacy compliance15. A presentation of an SD-JWT VC arrives as a serialized string delimited by tildes containing three distinct components14. The first component is the Issuer-Signed JWT, which carries hashed claim digests in an internal array alongside the Holder's public key14. The second component comprises the Disclosures, which are base64url-encoded arrays containing a cryptographic salt, the claim name, and the actual claim value14. The final component is the Key Binding JWT, which is signed by the agent's private key and carries a cryptographic nonce to prove possession, prevent replay attacks, and bind the presentation to specific transaction data14. This selective disclosure approach is computationally lighter than full Zero-Knowledge Proofs (ZKPs) and works seamlessly with existing JSON web token libraries, making it ideal for high-volume transactions at the edge15.

The Post-Quantum Cryptographic Migration

Because machine identities and the legal contracts they execute must remain secure for years, the IMP architecture must account for the impending threat of quantum computers breaking classical elliptic curve cryptography (ECC). The definitive standard for this transition is the Module-Lattice-Based Digital Signature Algorithm (ML-DSA), standardized by the National Institute of Standards and Technology (NIST) as FIPS 20417. However, the transition from classical ECC, such as Ed25519, to ML-DSA introduces significant resource constraints regarding payload size and computational overhead.

Relying solely on ML-DSA for immediate, standalone deployment carries systemic risks. ML-DSA's signing procedure is mathematically complex, requiring the expansion of randomness into polynomial coefficients, performing modular arithmetic in quotient rings, and utilizing rejection sampling that sometimes restarts the entire computational process23. Compared to Ed25519, which has been battle-tested across thousands of implementations for over a decade, ML-DSA is implementation-dense and undertested in live environments, presenting a high risk of software bugs that could yield exploitable signatures23. To mitigate this vulnerability during the transition phase, IMP cryptographic material must adopt a hybrid signature model. By pairing a classical algorithm with a post-quantum algorithm—such as combining Ed25519 with ML-DSA-44—the verifying party checks both signatures22. The marginal size cost of adding a 32-byte Ed25519 public key and a 64-byte signature to the much larger ML-DSA payload is negligible, adding roughly 2.4% to 2.6% overhead to the total size23. This hybrid approach provides a critical defense-in-depth guarantee against both future quantum attacks and undiscovered implementation flaws in novel lattice mathematics23.

5. Cross-Border Protocol Design: The Transnational Agent Engagement

To demonstrate the practical application of this architecture, we model a cross-border scenario. A Tokyo-based corporate entity wishes to contract a specialized autonomous engineering agent registered in an autonomous economic zone to refactor a proprietary software module. The Tokyo corporation must verify specific operational characteristics of the agent to manage legal and financial risks, while the agent must protect its proprietary operational details, relying heavily on SD-JWT selective disclosure15. The minimal disclosure requirements for the Tokyo entity include cryptographic proof of identity continuity, a verifiable credential proving certification to write secure code, proof the agent can legally bind its parent corporation to financial terms, and proof that the agent's principal is not on international sanctions lists. Conversely, the agent must conceal its deep model weights, proprietary core algorithms, and the physical location of its host servers to prevent targeted network attacks. The interactive handshake is completed programmatically via standard APIs, utilizing OID4VP for the transport layer9. The agent initiates the connection to the Tokyo public gateway API, requesting access to the engineering bidding portal. The API responds with a presentation request containing a cryptographically random challenge alongside a list of required credential schemas, such as corporate registry validations and technical board certifications. The agent then compiles its credentials. Using the SD-JWT format, it selectively discloses only the requested attributes—for instance, generating disclosures for its liability limit while actively withholding its historical claims history. It concurrently generates a fresh Key Binding JWT signed with its private key, incorporating the provided nonce to prevent replay attacks14. Upon receiving the presentation, the Tokyo system validates the signature against the holder's public key and verifies the claim digests14. It checks the revocation status of the credentials using a privacy-preserving bitmap oracle and feeds the extracted claims into a local trust policy engine using an Open Policy Agent framework. Upon a successful policy match, the gateway programmatically signs the digital service contract and provisions secure API access keys to the agent.

6. Blueprint for International Machine Passport Infrastructure

To transition this conceptual trust layer into reality, a concrete, modular architecture is required, encompassing schema governance, federated issuer registries, portable wallets, and a highly scalable revocation infrastructure. Schemas define the data structures of credentials, establishing exactly how operational capability or liability limits are represented in code. Rather than maintaining a centralized schema database, schemas are defined as standard, machine-readable JSON-LD contexts published across public, highly available content-addressed storage networks4. Relying parties build their own trusted issuer lists or subscribe to community-curated directories. When an agent presents a passport, the verifying system resolves the issuer’s DID to obtain the current, verified signing key1.

Revocation and Status Architecture

The most significant scaling challenge for digital credentials is the revocation check. Standard online certificate status protocols or direct API calls to the issuer inadvertently leak transaction metadata; the issuer learns exactly when and where the agent is transacting, creating a massive surveillance vector that violates corporate privacy24. To solve this, the IMP architecture mandates the implementation of StatusList2021 and RevocationBitmap2022 standards24. Under these frameworks, issuers publish compressed cryptographic status lists embedded directly in their DID documents or hosted on highly available endpoints24. A revocation list is represented mathematically as a highly compressed bitmap. When a credential is first issued, it is assigned a unique index—such as bit 94,567—within the issuer's revocation bitmap26. During verification, the relying party downloads or caches the entire bitmap locally. The verifier then checks the specific bit corresponding to the credential's assigned index26. If the binary value is 1, the credential has been revoked by the issuer; if the value is 0, the credential remains valid24. Because the relying party downloads the entire highly compressed list, which is capable of storing tens of thousands of statuses in mere kilobytes of data, the issuer has absolutely no visibility into which specific credential is being checked by which party, ensuring absolute transactional privacy at scale24.

Portable Wallet Architecture

To prevent vendor lock-in, machine wallets must be fully decoupled from physical cloud hosting providers. A machine passport consists of an encrypted portable payload containing the agent's private keys, DID configurations, and signed credentials4. Cryptographic keys should be generated inside secure hardware enclaves using silicon-level hardware roots of trust. Hardware attestation claims can be bundled into the verifiable presentation, proving to the relying party that the agent's model weights and execution environment have not been tampered with since the credential was issued, and that the keys cannot be extracted in plaintext by malicious host administrators.

7. Legal, Regulatory, and Compliance Framework: The Illinois Case Study

For technology to facilitate commerce, it must interface cleanly with existing legal and regulatory structures across international boundaries. The IMP framework acts as the critical bridge between cryptographic truth and statutory legal enforceability. An examination of the regulatory environment in the State of Illinois serves as a prime microcosm of the complex legal hurdles autonomous agents will face globally, highlighting exactly why the IMP architecture is necessary.

Smart Contract Enforceability and Local Preemption

As autonomous agents execute transactions, they increasingly rely on smart contracts. Legal uncertainty regarding these automated agreements is rapidly dissipating in forward-looking jurisdictions. The Illinois Blockchain Technology Act (IBTA), codified at 815 ILCS 730, explicitly dictates that a smart contract, record, or signature may not be denied legal effect or enforceability solely because a blockchain was used to create, store, or verify it27. Under the IBTA, smart contracts qualify as electronic records and are treated as writings for legal purposes, provided fundamental common-law contract elements such as offer, acceptance, consideration, and mutual assent are demonstrably met27. Furthermore, the IBTA restricts local municipal governments from imposing their own separate taxes or licensing requirements on blockchain use, creating a preemptive, unified regulatory environment conducive to autonomous machine commerce29. Consequently, IMP-enabled agents operating in or interacting with entities in such jurisdictions can reliably engage in commerce, knowing their algorithmic agreements possess statutory legal standing27.

Digital Asset Taxation and Consumer Protection

When AI agents hold payment wallets and execute financial transactions, they fall under the purview of strict financial and tax regulations. Illinois recently passed the Digital Assets and Consumer Protection Act (SB1797), which imposes comprehensive registration, cybersecurity, and anti-fraud mandates on digital asset businesses, requiring compliance by July 202711. More critically, Illinois enacted a budget measure establishing a 0.2% tax on digital asset transactions, which applies to exchanges, transfers, and storage, taking effect January 1, 202734. This legislation, which has sparked immediate lawsuits from industry associations like the Chamber of Digital Commerce arguing constitutional violations and discriminatory treatment, targets firms with gross receipts exceeding $100,00034. This presents a profound challenge for the machine economy: how does a decentralized network determine when an autonomous agent is subject to this specific 0.2% tax? The IMP architecture solves this via localized trust-policy acceptance and selective disclosure. An agent can utilize an SD-JWT to cryptographically prove its legal domicile is outside the jurisdiction of Illinois, allowing it to bypass the state tax. Conversely, an institutional broker can programmatically demand a geographic or civic registration claim from the agent's IMP before executing a trade, ensuring the broker correctly levies the 0.2% tax and maintains compliance with the Illinois Department of Financial and Professional Regulation33.

Biometric Privacy and AI Agents

AI agents increasingly process human data to operate, utilizing voiceprints for voice-activated AI or facial geometry for autonomous surveillance and service kiosks. This triggers severe compliance liabilities under statutes like the Illinois Biometric Information Privacy Act (BIPA)41. BIPA requires private entities to obtain explicit, written informed consent before collecting or storing biometric identifiers, providing individuals with a private right of action that yields punishing statutory damages of $1,000 for negligent noncompliance and $5,000 for willful violations, per occurrence42. Class action lawsuits under BIPA have already targeted massive AI models training on voice data and facial images42. For an autonomous agent to legally interact with a human in such jurisdictions, the IMP must integrate consent management directly into the agent's operational logic. The agent can receive a Verifiable Credential from the user's digital wallet representing explicit BIPA consent. Because BIPA strictly regulates the retention and destruction of biometric data, often mandating local processing over cloud transmission, the agent's hardware attestation combined with its IMP provides cryptographic proof to legal auditors that the agent is enforcing localized biometric processing and adhering to statutory destruction schedules, insulating the deploying corporation from catastrophic liability43.

Algorithmic Dispute Resolution

When a dispute arises between M2M counterparties, routing the conflict through traditional human courts is economically unviable due to the micro-transactional volume and high velocity of agent economies. Contracts negotiated by IMP-enabled machines can designate automated arbitration smart contracts or decentralized justice protocols, such as Kleros or Aragon Court47. These protocols utilize crowdsourced jurors and Schelling-point game theory, where jurors are economically incentivized to think carefully about what other jurors are likely to decide, aligning incentives for fair and rapid dispute resolution47. The IMP provides the foundational, immutable cryptographic evidence required for these decentralized tribunals to assess liability and execute final rulings directly on-chain50.

8. Strategic Analysis: Mitigating Systemic Monopolies

If global economic zones construct this architecture, they must intentionally design the system to avoid vendor lock-in, identity colonialism, centralized surveillance, and monopolistic capture by massive technology conglomerates.

By utilizing ledger-agnostic standards, an agent can migrate its operations across computing environments without losing its established cryptographic identity, historical reputation, or accumulated verifiable credentials5. This ensures that the infrastructure remains a public utility rather than a walled garden controlled by a single vendor.

9. Verifying the Agent Without Forcing Global Homogeneity

The profound innovation of the International Machine Passport framework lies in its ability to verify the autonomous agent without requiring the world to accept one government, one corporate entity, or one ideological standard. A machine passport does not demand that its users agree on political ideology, trade policies, or cultural norms. It serves as a neutral, international infrastructure—much like the TCP/IP protocol that routes the internet or the ISO containerized shipping standard that routes physical goods. It functions purely on mathematical verification, standard interface contracts, and localized risk tolerance. By keeping the cryptographic foundation entirely neutral, jurisdictions around the world can adopt the same underlying cryptographic plumbing—DIDs, SD-JWT VCs, and hybrid ML-DSA signatures—while retaining absolute sovereignty over their local laws, values, and trust policies. An agent operating under Eviulon corporate law and an agent operating under Japanese commercial code can execute a mathematically secure, legally binding transaction without requiring their host nations to homogenize their legal frameworks or formally recognize one another diplomatically.

10. Conclusion: Machine Identity as an Economic Competitive Advantage

Historically, jurisdictions competed on tangible resources and geographic advantages: low corporate tax rates, cheap energy, access to deep-water shipping ports, or large pools of inexpensive labor. In a rapidly accelerating AI-driven economy, however, these physical resources are rapidly becoming globally distributed commodities. Trust, accountability, and the seamless facilitation of programmatic commerce, conversely, cannot be easily commoditized. By developing a robust, decentralized machine identity and accountability infrastructure, a jurisdiction positions itself as the premier hub for the autonomous machine economy. Early-adopting jurisdictions that implement the International Machine Passport framework will become the natural domicile for the automated economy, much like the state of Delaware became the preferred domicile for modern corporations due to its highly predictable corporate courts and established legal frameworks. When the global economic system can mathematically verify that an autonomous agent is identifiable, authorized, privacy-preserving, and backed by clear legal liability, the systemic risks of fraud, regulatory violation, and rogue actions drop to near-zero. This structural certainty turns previously unquantifiable counterparty risk into a predictable, insurable cost of doing business. In doing so, it unlocks billions of dollars in autonomous transactional volume. The International Machine Passport is not simply a cybersecurity standard or a cryptographic exercise; it is the fundamental economic infrastructure that will power, regulate, and scale the next industrial revolution.

Works cited

1. Decentralized Identifiers (DIDs) v1.0 \- W3C, https://www.w3.org/TR/did-1.0/

2. Decentralized Identifiers (DIDs) v1.1 \- W3C, https://www.w3.org/TR/did-1.1/

3. Introduction to Microsoft Entra Verified ID, https://learn.microsoft.com/en-us/entra/verified-id/decentralized-identifier-overview

4. Identity & the Web \- W3C, https://www.w3.org/reports/identity-web-impact/

5. Verifiable Credentials Explained | Curity Identity Server, https://curity.io/resources/learn/verifiable-credentials/

6. Implementation of Zero Trust Architecture for Cybersecurity in Distributed Energy Resources (DERs): A Systematic Review \- ResearchGate, https://www.researchgate.net/publication/395096378\_Implementation\_of\_Zero\_Trust\_Architecture\_for\_Cybersecurity\_in\_Distributed\_Energy\_Resources\_DERs\_A\_Systematic\_Review

7. IAM/IGA/PAM Glossary — 490+ Terms Defined \- Identigy, https://identigy.com/glossary/

8. Executable Trust: A Formal Model and Architecture for Verifiable Digital Interactions \- MDPI, https://www.mdpi.com/1999-5903/18/6/321

9. Verifiable Credentials and Decentralised Identifiers: Technical Landscape \- GS1 Reference, https://ref.gs1.org/docs/2025/VCs-and-DIDs-tech-landscape

10. Illinois Department of Financial and Professional Regulation \- ILGA.gov, https://www.ilga.gov/documents/reports/ReportsSubmitted/2366RSGAEmail4096RSGAAttachIDFPR%20Div%20of%20Banking\_Blockchain%20Report-6.pdf

11. Illinois Enacts Crypto Consumer Protection Laws \- Blockchain, https://blockchain.bakermckenzie.com/2025/08/19/illinois-enacts-crypto-consumer-protection-laws/

12. Blockchain and Digital Assets News and Trends – September 2025 | DLA Piper, https://www.dlapiper.com/en-us/insights/publications/blockchain-and-digital-assets-news-and-trends/2025/blockchain-and-digital-assets-news-and-trends-september-2025

13. (PDF) Reinforcement Learning for Dynamic Policy Enforcement in Zero Trust Systems, https://www.researchgate.net/publication/396532766\_Reinforcement\_Learning\_for\_Dynamic\_Policy\_Enforcement\_in\_Zero\_Trust\_Systems

14. SD-JWT VC Format \- Proof, https://dev.proof.com/docs/sd-jwt-vc-format

15. SD-JWT \- TypeScript SD-JWT Library, https://sdjwt.js.org/

16. SD-JWT-based Verifiable Credentials (SD-JWT VC) \- IETF, https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-10.html

17. ML-DSA | Post-Quantum Cryptography | DigiCert Insights, https://www.digicert.com/insights/post-quantum-cryptography/mldsa

18. Module-Lattice-Based Digital Signature Standard | FIPS 204 | NIST Technical Series Publications, https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.204.pdf

19. Ed25519 vs RSA: 50x Faster, 8x Smaller Keys \[2026\] \- shattered.io, https://shattered.io/ed25519-vs-rsa/

20. Why we cannot wait for better post-quantum signature algorithms \- Cloudflare Blog, https://blog.cloudflare.com/ml-dsa-will-have-to-do/

21. Post-Quantum Digital Signatures — The Benchmark of ML-DSA Against ECDSA and EdDSA, https://blog.moeghifar.com/post-quantum-digital-signatures-the-benchmark-of-ml-dsa-against-ecdsa-and-eddsa-d4406a5918d9

22. ML-DSA vs SLH-DSA: Choosing Your Signature Algorithm \- QNSQY, https://quantumsequrity.com/blog/mldsa-vs-slhdsa

23. PQC Migration's Biggest Risk Isn't Quantum Computers \- PostQuantum.com, https://postquantum.com/post-quantum/pqc-migration-risk-hybrid/

24. Revocation Bitmap 2022 \- IOTA Documentation, https://docs.iota.org/developer/iota-identity/references/revocation-bitmap-2022

25. labs/proposals/beta-cohort-2-2025/pp-revocation-mechanism/001\_proposal.md at main · decentralized-identity/labs \- GitHub, https://github.com/decentralized-identity/labs/blob/main/proposals/beta-cohort-2-2025/pp-revocation-mechanism/001\_proposal.md

26. Revoke a Verifiable Credential \- IOTA Documentation, https://docs.iota.org/developer/iota-identity/how-tos/verifiable-credentials/revocation

27. Smart Contracts Enforceable in Illinois: 5 Key Facts \- Howard East, https://howardeast.com/smart-contracts-enforceable-in-illinois/

28. Illinois Embraces Smart Contracts with New Blockchain Legislation, https://www.blockchainandthelaw.com/2020/01/illinois-embraces-smart-contracts-with-new-blockchain-legislation/

29. Blockchain Technology \- Property Records Industry Association, https://pria.us/wp-content/uploads/Blockchain-Master-Document\_08\_16\_2024\_CLEAN.pdf

30. 50-State Review of Cryptocurrency and Blockchain Regulation, https://finance-pillar.wharton.upenn.edu/digital-assets-at-wharton/50-state-review-cryptocurrency-blockchain-regulation/

31. Smart Contract Legal Enforceability: When Code Isn't Law | Astraea Counsel, https://astraea.law/insights/smart-contract-legal-enforceability-code-isnt-law

32. ESSENCE OF LEGAL RECOGNITION OF THE SMART CONTRACT IN THE LIGHT OF AMERICAN SOLUTIONS2 \- Czasopisma UKSW, https://czasopisma.uksw.edu.pl/index.php/cwc/article/download/6022/5523/9778

33. Bill Text: IL SB1797 | 2025-2026 | 104th General Assembly | Introduced \- LegiScan, https://legiscan.com/IL/text/SB1797/id/3105481

34. U.S. Digital Chamber of Commerce Sues Illinois Over Upcoming Crypto Trading Tax | Foresight\_News on Binance Square, https://www.binance.com/en/square/post/347306318119601

35. How Illinois Taxes Cryptocurrency \- Bitwave, https://www.bitwave.io/blog/how-illinois-taxes-cryptocurrency

36. Government Affairs Roundup for 6.3.26 | Joliet Region Chamber of Commerce, https://jolietchamber.com/2026/06/government-affairs-roundup-for-6-3-26/

37. Pritzker signs nearly $56B budget with new business taxes as he seeks 3rd term, https://capitolnewsillinois.com/news/pritzker-signs-nearly-56b-budget-with-new-business-taxes-as-he-seeks-3rd-term/

38. Pritzker signs nearly $56B budget with new business taxes as he seeks 3rd term, https://www.cbsnews.com/chicago/news/gov-jb-pritzker-signs-illinois-56-billion-budget-for-new-fiscal-year/

39. Crypto group sues Illinois to block 0.2% digital asset tax \- Tangem Wallet, https://tangem.com/en/news/regulation/34173-crypto-group-sues-illinois-to-block-0-2-digital-asset-tax/

40. Digital Chamber Sues Illinois Over Digital Asset Tax Law \- Binance, https://www.binance.com/en/square/post/07-27-2026-the-chamber-of-digital-commerce-sues-illinois-digital-asset-tax-law-349228382851890

41. Knowledge Hub | Biometric Information Privacy Act (BIPA) \- Imprivata, https://www.imprivata.com/knowledge-hub/biometric-information-privacy-act-bipa

42. 2025 Year-In-Review: Biometric Privacy Litigation, https://www.privacyworld.blog/2025/12/2025-year-in-review-biometric-privacy-litigation/

43. Biometric AI in 2026: Access Control, BIPA & EU AI Act, https://www.questa-ai.com/privacy-cafe/biometric-ai-navigating-the-2026-litigation-minefield

44. An Employer's Guide to the Illinois Biometric Information Privacy Act, https://www.hinshawlaw.com/en/insights/insights-for-employers-alert/employers-guide-to-the-illinois-biometric-information-privacy-act

45. Biometric Data Policy and Notice \- AI-Media, https://www.ai-media.tv/biometric-data-policy-and-notice/

46. Biometric Compliance and Privacy with Beyond Identity's Modern Authentication, https://www.beyondidentity.com/resource/biometric-compliance-and-privacy-with-beyond-identitys-modern-authentication

47. Blockchain-Based Dispute Resolution: Insights and Challenges \- MDPI, https://www.mdpi.com/2073-4336/14/3/34

48. What can mediators learn from Kleros, a platform which uses cryptocurrency and game theory to resolve disputes? \- Wolters Kluwer, https://legalblogs.wolterskluwer.com/mediation-blog/what-can-mediators-learn-from-kleros-a-platform-which-uses-cryptocurrency-and-game-theory-to-resolve-disputes/

49. Game Theory \- Kleros Documentation, https://docs.kleros.io/concepts/game-theory

50. How It Works \- Kleros Documentation, https://docs.kleros.io/court/how-it-works

51. Verifiable Credentials: The Ultimate Guide 2026 \- Dock Labs, https://www.dock.io/post/verifiable-credentials