Why does checking whether my credential is revoked tell the issuer every place I use it?
Opportunity
Every deployed verifiable credential system needs a revocation mechanism. The dominant scheme, W3C Bitstring Status List, requires verifiers to fetch a status endpoint controlled by the issuer at presentation time, so the issuer learns exactly when and where each credential is used. The URL combined with the credential's fixed position in the bitstring is enough to re-identify the holder across verifiers, reversing the privacy that self-sovereign identity was designed to provide. CRSet, a zero-knowledge accumulator approach published in January 2025, solves the theoretical problem but no issuer at any meaningful scale has shipped a revocation scheme that does not leak presentation metadata back to itself.
Why it matters
Revocation that doubles as surveillance defeats the core privacy promise of holder-controlled identity.
機会をどう評価するか
The Opportunity Score is my own read, not a measurement: how much it hurts, how often it bites, and how little exists to solve it today. Higher means I think it is more worth building.
How much pain it causes when it shows up.
How often people actually run into it.
How little good tooling exists for it today.