What does blockchain add to digital identity?

Continuation from SSI - Digital Identity Problems.

When I joined Gataca the product was security led and blockchain oriented, not product led. Lots of very serious technology, very little clarity about what a normal person would do with it. So one of the first questions I had to answer for myself was simple and uncomfortable: what does the blockchain actually add here?

The honest version of the question is smaller than "can blockchain solve identity?". It is: which part of the relationship between a person, an issuer and a verifier gets better with a shared record that nobody can tamper with? Sometimes it helps. Many times it just adds cost and complexity without touching the real problem.

What a chain can really give you

A blockchain lets different parties agree on a small amount of shared state without one organisation owning the only database. In identity that state is things like public keys, a list of recognised issuers, or whether a credential has been revoked.

That is useful for coordination. It is not proof that a person is who they say. A chain can show that a key signed something, or that a record was not changed. It cannot tell you if the organisation behind the key was honest, if the original document was right, or if the person holding the key today is the same one who received the credential.

Cryptography proves relationships between data and keys. It does not create truth. "Trust through math" sounds very clean, and the math can be perfect while the issuer, the wallet, the verifier or the recovery process are badly designed.

Credentials, not accounts

The interesting change is not that a blockchain stores your identity. It is that you can hold credentials from different organisations and present them without opening a new account in every service. Your university issues your degree, your employer your role, your association your membership. You keep them in a wallet and show the specific claim someone asks for.

And the clearest benefit for the user is selective disclosure. To prove you are over 18 you should not have to send your whole driving licence. The service gets the smallest useful piece of evidence, not the full document. Some systems do this with zero knowledge proofs, others with other cryptographic formats. The technique matters less than the result.

With a limit: nothing stops the verifier from storing what you showed it, asking for more, or crossing it with other data. Privacy depends on the protocol, the interface and the behaviour of whoever receives the proof.

Revoking is not deleting

You hear a lot that with blockchain identity you can "revoke access to your data". Careful. A credential can be revoked. A permission can be changed. None of that deletes what another service already copied. If you gave a company your address, no transaction makes it disappear from their database.

And putting identity events on a permanent public ledger is its own problem. Great for audits, terrible for correction, deletion and privacy. A system that is hard to change is not automatically a system that is good for people.

Where it can be real

Finance: proving income or residency with a credential instead of sending your full file to every service. Fewer repeated checks, but underwriting and regulation are still there, and a wallet address is not a credit history.

Supply chains: linking a product to an issuer, a batch or a certification. Provenance gets easier to check. It does not prove the first data entered was true.

Health: portable credentials for consent, access rights or professional qualifications between institutions. Which is a very different thing from putting medical records on a public chain, please never.

Voting is the hard one. A credential can help with eligibility, but coercion, ballot secrecy and a trustworthy count are not solved by "blockchain voting".

The parts that are still hard

The user experience, first. Nobody should need to understand public keys, signatures or revocation registries to prove one simple thing.

Then keys. Lose the wallet and what exactly did you lose? Who helps you recover it, and how do they do it without becoming powerful enough to impersonate you? Giving people control with no safe way to recover is not user centred, it is just moving the operational risk onto them.

Linkability: use the same identifier everywhere and services can connect everything you do. Adoption: people will not carry credentials nobody accepts, and services will not accept credentials nobody carries. And institutions have very good reasons to keep their current systems, they understand them and they control them.

A modest role

I do not think blockchain identity replaces documents, banks, governments or platform accounts overnight, and I am not even sure it should. The realistic model is hybrid. Institutions keep issuing. People hold and present through wallets. Shared registries help verifiers check issuers, keys and status. The chain goes where a shared record adds real value, and stays out where a normal database is simpler, cheaper and easier to fix.

The test for me is practical. Do I disclose less? Do I understand what I am presenting? Can I recover access? Can I use the credential in different places without being tracked across all of them? Can I challenge an issuer or a verifier when they get it wrong?

If not, adding blockchain does not change the relationship. It just gives the same old problem a more fashionable vocabulary.