◆ Semantic Web Catalogue

Problem thread

Who vouches for it?

How can a reader tell whether a claim on the Web is true, and whose word to take for it?

issue
trust
also topology
status
open
steps
9, 1991–2022
threads
all problem threads

Anyone can say anything on the Web, so every system for data on it has had to decide whose word counts. PGP let people vouch for each other's keys, PICS let third parties label content, and Google ranked authority by links. The Semantic Web road map put signed statements and trust at the top of its stack. Two decades later, provenance vocabularies, verifiable credentials and content credentials supply parts of that layer, aimed at specific uses rather than at the whole Web.

Lineage

  1. 1991
    proposes project ★ seminal
    Pretty Good Privacy

    Encryption without a central certificate authority: users vouch for each other's keys, a model its 1992 manual named the web of trust. [src1][src2]

  2. 31 Oct 1996
    proposes standard ★ seminal
    PICS

    Labels that describe a page's content, distributed either by the publisher (self-labels) or by independent rating services (third-party labels), so readers can choose whose judgement to trust. [src1][src2]

  3. Apr 1998
    workaround writing ★ seminal
    The Anatomy of a Large-Scale Hypertextual Web Search Engine

    PageRank ranks pages by the links pointing to them, so the Web's link structure serves as a signal of authority with no metadata needed from publishers. [src]

  4. Sep 1998
    poses writing ★ seminal
    Semantic Web Road Map

    For reasoning to take trust into account, the logical model must be extended to include the keys with which assertions have been signed, and reasoning engines tied to signature verification. [src]

  5. 30 Apr 2013
    proposes standard ★ seminal
    PROV

    A W3C model for provenance: information about who and what produced a piece of data, which can be used to assess its quality, reliability or trustworthiness. [src]

  6. 26 Apr 2016
    proposes concept
    Self-sovereign identity

    Christopher Allen's ten principles for identity that people hold and control themselves, instead of borrowing it from a central provider or a platform login. [src]

  7. 19 Nov 2019
    proposes standard ★ seminal
    Verifiable Credentials Data Model

    Tamper-evident credentials whose authorship can be verified cryptographically, exchanged between issuers, holders and verifiers. [src]

  8. 21 Dec 2021
    proposes standard
    Content Credentials

    Signed provenance records attached to images, video and other media, recording who made them and how they were edited, which anyone can view. [src1][src2]

  9. 19 Jul 2022
    proposes standard ★ seminal
    Decentralized Identifiers

    Identifiers that their subject can create and control without a central registry, so whoever signs a claim can be named without relying on one authority. [src]

Recent signals

Dated events that show the problem moving, newest last.

  1. Sep 2025

    Google's Pixel 10 attaches Content Credentials to every photo its camera takes and logs edits made in Google Photos. Content Credentials[src]

  2. 2 Aug 2026

    The EU AI Act's transparency duties apply: AI-generated content must be marked in a machine-readable way.[src]

Open now

Under each question, the answers people have put forward or built. The catalogue gives no odds on them.

  • Can software reason with who said what, as the road map hoped, rather than only checking signatures? [src1][src2]
    The road map wanted documents parsed into assertions about who signed what; today's credentials and provenance formats verify origin but leave the judgement to the reader.
  • Whose keys and labels should a reader trust in the first place? [src1][src2][src3]
    PGP left it to individuals, PICS to rating services, and C2PA to the signers of each manifest; no general answer has emerged.
    • Device makers and platforms vouch. Content Credentials
      The Pixel 10 camera holds the highest assurance level in the C2PA conformance programme, so its signatures stand for the device.[src]
    • Governments vouch.
      EU member states must offer certified digital identity wallets to citizens by the end of 2026.[src1][src2]

Forces

Pressures that push this problem one way or another, as their sources argue them. All forces

Decision points

Dated moments when a decision or a deadline can change the outcome.

  1. 2 Dec 2026
    AI Act marking deadline for existing systems law

    Generative AI systems already on the EU market before August 2026 must mark their output as AI-generated by this date.[src]

  2. 24 Dec 2026
    EU digital identity wallets due law

    Each EU member state must make at least one certified European Digital Identity Wallet available.[src1][src2]

  3. 31 Mar 2028
    Verifiable Credentials Working Group charter ends charter

    The W3C group maintaining Verifiable Credentials is chartered until this date.[src]

How to contribute