Attestto develops and maintains two Decentralized Identifier methods — both on the W3C standards track, both with live resolvers, both open source.
These methods bridge existing trust infrastructure (national PKIs, domain name systems) into the DID ecosystem without replacing anything. Verifiers get interoperable resolution. Issuers keep their existing keys.
did:pki v0.1.0 Read-only DID method that deterministically derives DIDs from X.509 CA certificates in national Public Key Infrastructures. No registration, no on-chain writes — if a government CA exists, it already has a DID.
did:pki:cr:raiz-nacional Costa Rica Root CA did:pki:cr:sinpe:persona-fisica SINPE end-user issuing CA did:sns v0.4.0 Alias-anchored DID method using the Solana Name Service. Human-readable identifiers that resolve to DID Documents via on-chain lookup. Suitable for organizations, professionals, and any entity that wants a memorable, verifiable identifier.
did:sns:attestto Attestto organization did:sns:fi-cr Costa Rica finance authority A unified HTTP endpoint resolving both did:pki and did:sns identifiers. Conforms to the DIF Universal Resolver interface.
https://resolver.attestto.com/1.0/identifiers/did:pki:cr:raiz-nacional Returns a W3C DID Resolution Result with the CA's public key as JWK, certificate metadata, and PKI hierarchy information.
Over 100 countries operate sovereign PKI hierarchies for digital signatures. These hierarchies are islands — a certificate issued by Costa Rica's BCCR is unverifiable in Panama without custom tooling. The industry has tried several approaches, each with structural limitations.
| Approach | Depends on | Neutrality | Scales? |
|---|---|---|---|
did:pki | Mathematics (X.509 certificate) | Full | Automatic — add certs, get DIDs |
| Trusted Lists (eIDAS) | Diplomatic agreements per country pair | Medium | Slow — requires treaties |
| Vendor programs (Adobe AATL) | Private company's inclusion criteria | None | Easy — but you lose sovereignty |
| Bridge CAs (Federal Bridge) | Central authority cross-signing | Low | Rigid — single point of political control |
did:web / did:tdw | DNS infrastructure + hosting | Medium | Easy — but domain dies, DID dies |
did:pki takes a fundamentally different approach: deterministic derivation from the certificate itself. No registration, no agreements, no vendor dependency, no DNS reliance. If a government CA certificate exists, it already has a DID — any conformant resolver will derive the same identifier and return the same public key.
This is the technical fast lane: instead of waiting for diplomatic agreements to recognize trust lists, did:pki translates the trust that already exists in the certificate into a language that modern applications (wallets, verifiers, smart contracts) understand natively.
These aren't hypothetical. Each use case below is either live or in active development, using did:pki and/or did:sns for identity resolution and credential verification.
Costa Rica's Firma Digital PKI hierarchy (BCCR/MICITT) mapped to did:pki. Every CA — root, policy, issuing — resolvable as a DID Document with its public key. Enables cross-border signature verification without bilateral agreements.
PDF documents signed with national digital signatures (PKCS#7/CAdES) verified cryptographically in-browser. The verifier doesn't need to bundle every country's trust store — the resolver provides the CA public keys.
LiveProposed framework for Verifiable Credentials for licensed professionals (doctors, lawyers, engineers). Professional identity anchored via did:sns, issuing authority verified via did:pki chain.
Proposed mobile driving license architecture following ISO 18013-5, with mastery-based continuous competency verification. Exam proctoring, decay scoring, and renewal gates — anchored to the holder's DID.
ProposedThe did:pki resolver draws from the attestto-trust repository — an independent, open-source mirror of national PKI root and intermediate CA certificates. Adding a country means adding its certificates to the trust store.
Want your country's PKI in the trust store? Reach out or submit a PR.