6500 words
INTRO: I’ve had several significant breakthroughs over the past two weeks and did a fundamental redesign of Trust Mesh that mitigates the issue of phone sensors not being ready to provide enough detail for uniqueness with a new approach. I also developed the Sovereign Digital Vault as a full specification and investment thesis as the wedge product to fund the network, which is next week’s article.
Today’s article addresses the uniqueness problem and why Trust Mesh’s open standard is the best design for the future of our digital systems, with comparisons to World ID’s iris scanner, Humanity Protocol’s palm recognition, passport readers like ZKPassport and Self, and the passkeys Apple and Google already put on our phones.
The Uniqueness Problem
A challenge for digital systems is proving that an account or transaction is one unique human who has not already been counted and is present without revealing who it is. Uniqueness is distinguishing each human from the other eight billion on the planet. Legacy systems approach uniqueness by tying every account to a real identity, but it comes at the cost of trackability and sensitive data vulnerable to a breach. Blockchain removes the identity with bearer keys but there’s no way to know how many accounts any one person controls, so it doesn’t work for any process requiring an exact count of participants, like voting.
The Trust Mesh original design used phone sensors at onboarding to create one Slot for each human by turning face and voice inputs into a unique stable number with a stabilizer that separated into three lanes: one was stored on the network as a blinded marker that was impossible to reverse back to the face; a second was stored on the phone for local authentication of transactions; and a third was stored on the network as a separate blinded marker to recover a Slot onto a new phone if the original device was lost.
This is the ideal design because it uses onboarding hardware everyone already has, so there is no centralized process or company in control, and by separating those three lanes using blinded markers it allows one human to map to one Slot, thereby creating a third account type of anonymous accounts backed by unique humans, open to every company through one shared registry. This is the highest bar of privacy and security for navigating digital systems with decentralized accountability and fraud control by requiring real-time human authorization for actions ranging from logging in to wire approvals to AI agent restraint.
I created this ideal design knowing I would circle back and refine the onboarding if the results showed too many collisions between people who looked too similar for phone sensors to distinguish or a false acceptance rate that’s too high, allowing too many people to get a second Slot by onboarding again with changes like different lighting conditions or new facial hair. This is vital because any process that requires an exact count of participants like surveys or voting needs to know there isn’t a way for people to game the system by stuffing it with duplicate slots they control.
The Sensor Problem
When I went back through what today's phone sensors can actually capture, I don’t think we’re quite there yet. A phone camera can't produce the blinded marker steadily enough for it to distinguish billions of people. Environments change, and lenses differ from one phone to the next, so there is too much noise that can’t reliably be reduced to a stable, repeatable number until we have more advanced sensors, which will happen in time, so it was worth exploring the best design, but it needs an adjustment to work now. The same person cannot come out as two different markers on two different days, and two different people cannot be too close to tell apart. At the scale of a global registry, if both of those mistakes happen often enough, it breaks the exact count of unique participants we’re trying to achieve, but waiting for technology to catch up could mean years, so I redesigned how the network achieves uniqueness.
The redesign works with today's phones and carries the ideal design inside it from day one to migrate seamlessly in the future as consumer phone sensors evolve. For now, when you enroll, your phone captures your face and four fingers with its camera, seals that capture so no one can read it, and sends it to the shared registry, where independent operators compare it against everyone already enrolled without any of them ever seeing it. That sealed capture is the stored reference. It is what the registry stores to determine your uniqueness, and nobody who holds a piece of it, including the operators, can see the face inside it.
This reference is compared to others for closeness matches, which is far more forgiving of a bad angle or a new beard than using a single stable number, so the registry can tell people apart using today’s sensors. The downside is a reference has to be stored, which I very much wanted to avoid because I did not want to create a honeypot of identity that could leak, whereas the number of a blinded marker in the original design was destroyed and discarded completely. This is a compromise of my ideal for the wide-ranging benefits of a system that works now while retaining the aim of returning to the ideal in the future.
The sealed capture gets a person into the registry, but it does not yet let them act. Before a Slot can count in a vote or approve anything, it has to pass a second gate: a document check, or a short visit in person for anyone without a document. Both paths carry the same weight, so nobody is shut out for lacking paperwork. The capture also has to prove it came from a live person and not a photo, a replay or an injected video, and the face and fingers belong to the same body. The phone's secure chip then attests that the genuine Trust Mesh app made the request. If you lose your phone, a separate recovery process with its own keys and committee moves your Slot to a new one, and your other devices can contest it if someone who stole it tries without you.
The blinded marker is still computed beside every sealed reference from the very first enrollment and runs in shadow, so nothing relies on it yet. Its error rates can then be measured across the live network and published. The network would be measuring itself as every enrollment adds to a public record of how much detail real phone sensors produce in real hands in real time. That record, together with controlled studies against known ground truth, decides when the blinded marker is ready on its own. Once the measurements pass their published gates, a governed rule change can let admission run on the marker, but the sealed references would keep being deposited as redundancy, in case the network needed to switch back for any reason. So the ideal design would get tested on real phones, by real people, while the network grows using a new design that is functional without creating a honeypot of identity to attack.
The sealed reference has its own numbers to earn. How often it wrongly matches two different people, how often it fails to match the same person twice, how well the capture screens out photos and fakes, and how often a review wrongly holds up an honest person are all to be measured in the field and published. The birth date and first name taken from a document only help settle close calls. So the new design, like the old one, launches on numbers it has to prove, but a much lower bar to clear for deployment because it asks a lot less of our sensors to work, which is the point.
One Global Human Registry
Vitalik once wrote an article expressing concerns about the idea of a single global registry, which are all valid, so let’s explore how Trust Mesh solves them.
Stateless people without documents would be excluded. Trust Mesh uses biology first, then redirects collisions or edge cases to in-person local onboarding.
A dual citizen in a passport-based system gets two identities from two passports. The new Trust Mesh design uses a document only as a second gate after the body is admitted, so a second passport cannot create a second Slot.
Fake documents from a hostile issuer get the same answer. A fake passport can’t create a Slot because the body decides admission.
Damaged features: the capture uses face plus fingers, and cases that capture gets wrong go to supervised review and in-person adjudication at a witness desk. The whole design is to reduce these numbers to the minimum possible.
Grown body parts and replicas remain open. The specification names synthetic captures and presentation attacks as known risks, bounded by liveness and injection checks, app attestation from the phone's secure chip, and error rates measured and published in the field. A replica good enough to fool a camera would fool an iris scanner or a palm reader too, so no biometric design escapes this. What Trust Mesh changes is the cost. A fake seat has to appear live at every counted act to execute, so a body part farm, if such a thing exists, needs its replica in front of the camera every time it votes or collects, and each extra seat needs a body part of its own. No identity system built thus far is free of edge cases. The idea is to make each one expensive, rare and visible.
The privacy and security of the Trust Mesh design makes the advantages of a single global registry far outweigh the disadvantages, especially with edge cases reduced as narrowly as possible. If we want an exact count of unique participants, there is no known way around a single registry, or several that cooperate, which amounts to the same thing. If several registries existed, every participant could hold a seat in each one, so there would have to be a shared deduplication process, which is then a shared registry. A system of multiple registries could still prove a present human approved a transaction, so real-time authorization could keep working, but no registry would know whether that person also held seats in the others, so voting, surveys and any process requiring an exact count would lose the one thing they need, which is the entire crux of the uniqueness problem.
Uniqueness only works inside one registry. Phone service works the same way: many carriers sell phone numbers, but every carrier draws from one numbering plan, so one unique number reaches the same phone anywhere in the world. The key is onboarding must be an open standard, so no single company owns the global human registry. That way there can be many doors into the same verifiable room.
The Open Standard
Since no company will onboard its customers into a competitor's database, a corporate walled garden can only ever count its own customers, which is one of several reasons Big Tech cannot solve this problem with a corporate product.
The first open part of Trust Mesh is the onboarding protocol itself. Any company implementing the standard is building a door into one shared registry with standardized rules for capturing a person's face and fingerprints, sealing the capture on the person’s device so no one can read it, and sending it to the registry, which checks whether the person is already enrolled, and creates a Slot if they are not. These shared rules make every capture comparable, so one person cannot get two Slots through different doors, which is the only way a decentralized system can ensure an accurate count of participants isn’t full of duplicates or fakes.
Here’s what comprises the open standard, so any company can build a door:
The capture rules. Defining what a conforming capture is for each kind of door: a phone, a card, a public terminal or a supervised desk. This determines which features are used, the liveness and injection checks, and the requirement that the device attest it is running the genuine app.
The sealing format. Each door simultaneously encrypts the capture to the registry’s key on the person’s device, so the onboarding company never holds a usable template, and the operators of the network never see it either.
The admission rule. This is how the registry compares a newcomer against everyone already enrolled: admit, refuse as a duplicate, or send to review are defined procedures. It’s one published rule, so a person gets the same answer whichever door they try to enter through.
The second gate. This defines what a document check or an in-person visit must verify before a Slot can count in a vote or a payout. Documents only corroborate; they never create a Slot.
The credential and the receipt. This defines how the new Slot’s credential is issued without the network seeing inside it, and the receipt format any business can check.
The marker computation. The method that turns a face into a blinded marker is public, so anyone can check that it is computed the same way everywhere. The markers themselves stay sealed.
The conformance tests. These are published tests a door must pass before its captures are accepted by the registry.
Here’s what is not open to anyone:
Running the registry. The operators who hold the enrollment shares and run the comparisons are bonded and admitted under the governance rules, and capped by country and owner. A company can become an operator, but not just by downloading the standard.
Certifying a door. A door’s captures count only once it passes conformance and its devices’ attestation checks out. That’s the defense against a door that would feed in fake people.
The second part of the open standard of Trust Mesh is the receipt. Enrollment allows a unique person to exist both on the network for uniqueness and on their phone for local authorizations. The receipt is what carries their uniqueness into every act they approve. Each time the person approves something, their phone's own biometric unlocks it and produces a receipt under a lease issued only to an enrolled Slot, tying that approval to that action. For counted acts like voting, the phone takes a fresh live capture, and the registry checks it against the Slot's own sealed reference on the network, so one person cannot be counted twice. A bank, a newspaper, an AI agent, or a robot acting for them verifies the receipt against the network's published parameters, without calling anyone and without learning who the person is. For that to work, every receipt must follow the same rules no matter which door the person enrolled through.
No business can keep a separate verifier for every company that onboards people, any more than a store could accept a different kind of currency from every bank. This matters most for any process that requires a trusted count. An election can only count each person once if every receipt marks a vote the same way, so a second vote from the same Slot is caught no matter which door that person enrolled through. Privacy has to be built into the format itself, so no company can add a field that lets businesses compare notes on who you are or how you voted. One standard receipt means any business in any industry can verify any person's receipt, every count stays trusted, and no two receipts can be linked back to the same person.
I filed patent applications on both the onboarding protocol and the receipt, which are pending. A nonprofit foundation will hold and license them on published, uniform terms to any implementation that interoperates with the open standard and feeds the shared registry, so no company can be shut out, and no company can fork the count. The patents exist so the standard can be built the way it is designed, with every door feeding one registry and every receipt counting the same way, because an open standard is a design that beats walled gardens. A shared registry benefits Big Tech companies far more than any version confined to their own ecosystems. A phone maker whose devices become doors into a global registry reaches every service on earth that checks a receipt, across dozens of use cases and every industry, which gives customers a reason to buy the latest, most capable phone. A uniqueness system built for its own ecosystem stops at the edge of its current customers and never reaches past it. Leading the implementation of an open standard increases a company's total addressable market past anything a walled garden can reach.
Uniqueness Without Identity
Anyone who proposes a global registry needs to answer two questions: how does the design prevent capture by corporations and governments intent on creating the ultimate surveillance system, and how does it prevent its database from being exploited by hackers, which would only add to the data breach problems we have today. This is where cryptography shines. The whole idea is for the registry to retain the least amount of data possible to perform a uniqueness check, distribute it widely among validators, and employ privacy techniques that don't reveal it to anyone. The surest way to prevent a data leak is to never store the data, and the next surest is to store only data nobody can read.
The registry keeps one row per person and nothing filed under a name, an address, a document number, or a photo. What it stores is a sealed reference to the person's face and fingerprints, just enough to tell whether a newcomer has already enrolled, and a sealed face marker computed beside it. When someone attaches a document at the second gate, a few general facts such as birth date and first name are sealed the same way to distinguish close matches. A separate recovery committee holds the sealed recovery anchor. After three years with no lease renewal or other ceremony, all of it is deleted. The registry never sees what people do after they are enrolled because the receipts generated at businesses for login or authorizations go straight to the business and the person’s encrypted vault on their phone and never touch the registry that holds the sealed references. The network certifies receipts in sealed batches without seeing who approved what or for which business, so there is no record of anyone's actions to steal or any linkability between services.
The sealed reference is split into pieces and stored by independent validators in different countries who cannot read even the individual pieces they hold. At launch, ten independent operators hold the pieces and seven must act together for every check. At full maturity, each epoch draws a custody committee of four to seven from hundreds of bonded validators around the world, and about two thirds of them, five of seven at the largest size, must cooperate to run a uniqueness check, which is done without reassembling the sealed pieces, so only a verdict of yes or no is produced. Cracking open a reference requires that same threshold of colluding validators, and the random draw is capped so that no single country, owner, cloud provider or hardware vendor can fill enough seats to reach it alone. The committee is kept small because every member takes part in every check and the pieces are rotated among them each epoch, so a larger committee costs more per check; the size is a published parameter that can increase as hardware gets cheaper. An attacker cannot know in advance which validators to target, because the next epoch's committee has not been drawn yet.
The pieces sit in secure hardware from at least three vendors, with no vendor holding more than about a third of the seats, and because they are rotated at every epoch a piece stolen in one epoch is useless in the next. The only computations allowed to touch the registry are published in advance, and amending that code requires a supermajority of validators and a public waiting period, so any attempt to turn the registry into a search engine would be announced before it could happen.
A government or corporation that wants to capture the registry has to own two thirds of a custody committee it cannot predict. At maturity the committee is drawn each epoch from hundreds of bonded validators, the caps force its seats across countries, owners, cloud providers and hardware vendors, and the pieces rotate when the seats do, so a capture has to be repeated every epoch to hold. Compelling seven of ten named operators at launch, or five of seven unknown ones a month at a time at maturity, would have to happen across countries that do not trust each other, simultaneously and in the open.
A hacker has to breach that same set before the pieces rotate, whereas a typical company database falls to one stolen password. Even in the worst case, if a full threshold colluded at once, what they would get is the membership list and the sealed references, which could be worked back into rough faces, birth dates and first names, and a record of which Slots took part in which elections or payouts, though never how anyone voted, because the count is kept in a separate lane the registry never sees. They would not get a single receipt, a single purchase or login, or the authority to approve anything for anyone, because none of that ever reaches the registry. That is a prize deliberately designed to be uneconomical to take.
This is exactly why the design keeps the custody committee small enough to audit, draws it fresh each epoch so nobody knows whom to capture, and deletes what it holds after three years of silence. The design is also built to migrate to the original blinded markers as phone sensors improve. Admission can then run on the marker alone, and once the measurements show the references are no longer needed, a governed change can retire them, which removes the one prize the worst case leaves. This is how a global registry can use cryptography to produce a shared system that cuts fraud, restrains AI agents with human authorization, and carries one receipt across every industry with no company or government in control.
The Coming DeepFake Crisis
This is a dualistic world. There is benevolence and maliciousness, so a tool as powerful as AGI, at whatever level of intelligence it reaches, serves the people curing cancer and the people attacking our systems alike. Both get the same tools. The bad actors do not have to run their agents through a public frontier lab. They'll run open models, or create their own agents on their own machines. They'll be independent laboratories with a mission of continuing to scam people and businesses by exploiting the security weakness of our system of identity and bearer accounts.
What AI technology is making cheaper by the day, and therefore more scalable by the day, is deepfake technology. A malicious lab will have thousands of agents scouring the web to assemble a human dossier on everyone from whatever data, photos, and videos they can find online. They will clone everyone's voice. They will know where you live, who your close relationships are, and where they live. These bots will figure out who is most susceptible to being scammed and run one of dozens of schemes that self-improve over time.
Imagine getting a text from your adult child or a parent on a Thursday. It says, "Hey, I'm taking a road trip on Saturday. I'll be back by the evening. Just wanted to let you know. Hope you're having a great week!" On Saturday another text says, "Do you have a quick second for a call?" If you say yes, a video call rings and there will be what looks like your child or your parent on the side of the road, with trees behind them and traffic sounds. "Hey, I ran out of gas and my stupid credit card is locked for some reason. Someone's gonna give me a ride to the gas station, but I don't have any cash on me. Can you send me $100?" They'll text you a link to their account with their name on it, except it's not their account because it’s not them; it’s a deepfake sending money to a scammer.
These bots will figure out which story makes the most sense per individual and run dozens of schemes on autopilot 24/7. You might get a call from your brokerage. Or a charity you donated to in the past. It will get to the point where we won't be able to tell whether an incoming text, email, video or picture is real. And once a capability threshold is reached it could go from zero to a hundred real quick as it spreads all over the place.
Good AGI and malicious AGI will battle it out on this digital playing field for control of our credentials and devices. Our cybersecurity firms will try to defend us with good AGI, but we cannot assume good AGI will always stay one step ahead of bad AGI. Think about how many endpoints there are. Every phone, inbox, bank login and payment app is a door. At today's human speed the damage is contained; at machine speed, with malicious AGI at the helm, it is billions of doors at once, and the defense has to hold on every one of them every single time while the bad guys only need to get through once. No cybersecurity firm can guard all of those endpoints one at a time. The malicious agents will find a way around the good ones in enough cases to make fraud worthwhile.
That is why this problem cannot be solved on the same layer where it exists. It must be solved on the human level with human authorization. The gate has to originate from a human, present and unique, who authorizes an action or a permission one layer down from the digital arena, on the phone's secure hardware that binds the approval to an exact act. The attacking AI sits in the middle with no ability to forge it, since it cannot be the human above and it cannot sign for the secure chip below.
A deepfake can copy your face and clone your voice, but it cannot produce a fresh receipt you approved, live, on your own phone, for a specific amount going to a specific account. The bank would verify the receipt before executing the payment, so even a deepfake of you gets nothing from your accounts if no part of the process can produce a receipt but you.
This only works if everyone verifies against the same receipt standard. The digital arena is way too complex to be broken up into hundreds or thousands of ecosystems running their own proprietary systems where every gap between them is a place for a scammer to slip through. The only way to close all of those gaps at once is a shared open standard that every bank, phone maker and app can download and build against at the same time. And since no corporation owns it, governments can mandate it for consequential actions like wires and logins. Ultimately, Trust Mesh is designed so that stealing your credentials or producing a deepfake of you is not enough to access your accounts or authorize an action. That doesn't make it unhackable, but it is designed to contain risks and make attacking it uneconomical.
All Roads Lead to Trust Mesh
(I had Claude research and write this section from each project's own documentation and code, so that the comparison rests on what they publish and not on my opinion of them, which could be biased.)
Every system that claims to prove a real human has to answer five questions. Does it count each person once across the whole world? Does it check that the person is present at the moment of each action, or only once at signup? Can the services a person uses track them with it? Who controls the door people enroll through? And who could capture the registry behind it?
The comparison below comes from each project's own published documentation and code as of October 2026, analyzed in five separate review passes, one per question, and every claim about another project is drawn from that project's own documentation, with the two exceptions noted on passkeys. One difference applies to all of them: the others are running today, and Trust Mesh is a published specification that has not yet launched.
At a glance
World ID
World gets more right than any other project. Its Orb scans the iris, splits the result into encrypted fragments on the device, and sends them to independent operators who check for a duplicate jointly and learn only one bit, whether this person has enrolled before. Proofs are scoped to each app, so services cannot link a person across them, and Face Auth compares a fresh selfie on the phone against the face image from the Orb visit, so a stolen account is harder to use.
The registry is where it falls short. By World's own code, the uniqueness check runs on exactly three named institutions, under a security model that assumes no two of them collude and that all three run the published software faithfully. Every node runs on the same cloud provider, and the sources describe no bonds, no penalties and no limits on shared jurisdiction or ownership. The three parties are chosen by a governance board whose membership and rules are not published, and the whitepaper says the service "still requires more research before it can be made more permissionless." A global registry cannot rest on three fixed, publicly named parties that two colluding members can open.
The door is the second problem. Every enrollment runs through an Orb, Orbs are built by one company, and the Foundation decides which Orbs may join, so who can enroll, how fast, and in which cities, depends on where that hardware is deployed. The Foundation approves and signs the firmware every Orb runs, so the door's integrity rests on that one signer. The package the Orb sends to the phone holds raw iris and face images, and the network keeps iris-code shares with no stated retention limit.
The receipt is the third piece lacking. A World ID proof shows that an authorized key signed it, and in version 4.0 that key can be one of several across devices, seven by default and up to 48, including keys made for software agents. Whether a live human was present is an optional check the app runs on the phone, and the signed version of it exists only in a draft proposal, attested by a single vendor. Every World ID is also a public on-chain account whose key changes and recoveries are recorded with timestamps, the default verification path sends each proof to a World-hosted endpoint, and the specification notes the authenticator app could track the user, which is the kind of honesty that this work demands, so that is commendable.
Trust Mesh answers each of these differently. At launch, custody sits with ten bonded operators under caps that force them across countries, owners, cloud providers and hardware vendors, and seven must act together. The rules then specify how that grows: once the operator count passes a published ceiling, each epoch draws a custody committee at random from the whole set, and the shares rotate with it, so an attacker cannot know in advance whom to capture and a stolen piece goes stale. World's own whitepaper says its path to more parties still needs research; Trust Mesh's path is written with its trigger. Any phone or certified device that passes the published conformance tests is a door to the same registry. The receipt binds the exact action, the exact amount and the moment of approval on the holder's own phone, is verified by the business against public parameters without calling anyone, and carries nothing that links it to another receipt, even for the network that signed it. If the lite launch path is taken, the handoff to independent validators has a deadline written into the software.
To match that, World would need to open its door into a standard any device maker can implement, move its three fixed parties to drawn committees under enforced caps, make live presence part of every consequential proof, and take the verification path and the account history off its own servers and chain.
Humanity Protocol
Humanity starts where Trust Mesh does, on the phone people already carry. Its first phase reads the palm print through the phone camera, and a later phase adds a plug-in infrared device for palm veins. That reach is its strength, and its whitepaper claims population-scale accuracy only for print and vein combined, not for the camera scan its basic check accepts on its own.
The registry is the problem. By its own whitepaper, the company's Core Platform is today the sole issuer of the human credential and runs the duplicate check itself, holding each user's encrypted palm signature paired with their wallet address and their personal-data credentials in sharded form. The paper lists three cryptographic methods that might protect the matching without choosing one, says raw palm images are never stored and elsewhere describes a database of them, and leaves the conditions for decentralizing as placeholders, "at least X independent validators" and "no single validator more than Y%," with no date. Later issuers are chosen by token stake, and 29 percent of the supply goes to the team and investors. Its minimal login scope, labeled "Human Verification Only," also hands each service the user's email, phone number and a Humanity identifier. Its on-chain check is recorded against the wallet, and its example contracts reuse a verification for 30 days. There is no per-action receipt and no recovery: a check returns whether a wallet holds a verified-human claim inside a window, and the documentation presents having no recovery process as a feature.
To match Trust Mesh, Humanity would need to run the duplicate check inside one named threshold computation among independent, capped parties that no token stake can buy, drop email, phone and global identifiers in favor of unlinkable per-service proofs, bind a live check to each consequential action, and specify a recovery lane.
ZKPassport and Self
These read the chip in a passport or national ID with a phone and prove facts about it using zero knowledge, such as age or nationality, without revealing the rest. They reach anyone with a chipped document and need no new hardware, and ZKPassport is honest in its documentation about what its face match can and cannot do.
They count documents, not people. ZKPassport describes its uniqueness as "one ID, one account," so a person with two passports holds two accounts and a person with none cannot enter. Self accepts a passport, an EU identity card, India's Aadhaar or a partner's KYC attestation with no check across them, and concedes an Aadhaar identity can be reset by changing its fields. Both derive the identifier from one document's chip data, so a renewed passport presents as a new person, and the identifiers are scoped per service, so there is no single count anywhere. The root of trust is the issuing government. By its own FAQ, ZKPassport's default identifier can be recomputed by the issuer; the salted alternative is off by default and runs on a 2-of-3 network with ZKPassport among the operators. Self concedes an issuer can detect whether a given passport registered.
Presence is weak or absent. ZKPassport's face match is optional except for salted identifiers, uses a head-turn challenge with no passive anti-spoofing model, has unmeasured error rates on chip photos, and is reused for 30 days. Self's protocol has no face match, its notes acknowledge that someone who reads a passport once can register it before its owner does, its recovery is unshipped, and its registration proofs run in a server-side enclave Self operates while its quickstart says only the proof leaves the phone.
To match Trust Mesh, both would need to admit people by the body and demote the document to a second check, so that a second passport cannot make a second person and a person with no document can still enter; feed one shared registry instead of a count scoped to each service; derive identifiers no issuing government can recompute or recognize; hold their secrets under a larger capped committee; bind a fresh live check, with measured and published error rates, to each consequential action; make that check a receipt any business can verify without calling them; and ship a recovery path.
Passkeys
Passkeys are not a uniqueness system, and they do not claim to be. A passkey is a key held on a device and unlocked with your face, fingerprint or PIN, with a different key for every site, so sites cannot link you. That makes them the best authorization layer most people already use, and Trust Mesh shares their root: its everyday receipts also rest on the phone's secure hardware and biometric unlock, and it names Apple and Google's device attestation as one of its own trust assumptions.
What a passkey proves is that the device's lock accepted someone. The WebAuthn standard says so itself: user verification "does not give the Relying Party a concrete identification of the user," and people sharing an authenticator "are considered to represent the same user." One person can make unlimited passkeys and unlimited accounts. A passkey signs whatever challenge the site sent with no display of the amount or action, and the transaction-confirmation extension that once existed is absent from the current standard; Apple Pay and Secure Payment Confirmation do bind an amount and payee, which is the one piece of a receipt the platforms already ship. Synced passkeys follow whoever controls the platform account, with no backup protocol in the standard, so each vendor's sync and recovery sits inside the trust base. This is also where Big Tech stands: the platforms can do authorization well, and uniqueness is outside their reach because each can count only its own customers.
To match Trust Mesh, a passkey would need one seat per human behind it, a receipt that hashes the action the person saw into what they sign, an issuer that cannot link two of a person's receipts, and a root no single company controls. Trust Mesh keeps the passkey experience and adds exactly those four.
The Common Thread
Each of these projects solves part of the problem well. World has the strongest private duplicate check, the passport readers have the widest low-cost reach, and passkeys have the best everyday experience. None of that has to be thrown away. Any of them can become a higher-assurance door into the same Trust Mesh registry: an Orb, a palm-vein reader or a passport check can admit a person under the shared standard, and a passkey can carry the receipt. What each would give up is owning the uniqueness count, which only works when every door feeds one registry.
Where to Read More
The new Trust Mesh specification, Essential Guide and full vision expressed in The Trust Standard book, among other additional materials, are here: Trust Mesh.
An Invitation
The easiest way for this to happen is for Big Tech leaders to realize a global open standard benefits them vastly more than each company creating its own proprietary version, not only for the hardware upgrade cycles but the vast inference that an open standard enables for AI agents anchored by human authorization.
Next week's article covers the Sovereign Digital Vault, which is the wedge product that will fund the Trust Mesh network if nobody larger chooses to build it.
