Four levels of signed lists connect every Issuer to one anchor that VDSIC operates.
VDSIC publishes the Root LoTL. It references each accredited Scheme Operator, whose lists name the TSPs and, through them, every Issuer certificate.
If a scheme fails, VDSIC removes it from the Root LoTL. Seals from other schemes keep verifying: there is no single point of failure.
VDSIC Office and Governance Council
The ultimate trust anchor, signed offline in an HSM
Scheme Operators and TSPs
One scheme per domain; TSPs list Issuer certificates
Issuers
Sign with X.509 certificates whose keys never leave an HSM
Verifiers
Walk the chain back to the Root LoTL, offline if needed
| Role | Responsibilities | Standards |
|---|---|---|
| VDSIC | Maintains specifications and security policy, operates the Root LoTL, accredits Scheme Operators, monitors compliance | ISO 22385, KB036 |
| Scheme Operator | Runs a domain scheme, publishes its Scheme LoTL, validates Manifest IDs, oversees its TSPs and Issuers | ISO 22385, VDSIC policy |
| TSP / Certificate Authority | Issues X.509 signing certificates to authorised Issuers and publishes TSLs | ETSI EN 319 411-1, TS 119 612, RFC 5280 |
| Issuer | Creates and signs seals under the scheme rules, with keys kept in an HSM | ISO 22376, Manifest |
| Verifier | Reads the seal from any carrier and runs the full verification chain | ISO 22376, ETSI EN 319 102-1 |
01Acquire VDS data from the carrier, Passed
02Retrieve and validate the trust list chain, Passed
03Locate Manifest and certificate, Passed
04Validate resource signatures, Passed
05Process the Payload, Passed
06Verify the VDS signature, Passed
07Present the result (RFF), Passed
Trust lists are signed XML documents (ETSI TS 119 612 with VDSIC extensions) forming a verifiable chain.
Manifests define each use case's data schema, validation and presentation.
Signing certificates link an Issuer to its public key and carry VDS policy identifiers.
Generation
Keys are created inside hardware security modules and cannot be extracted.
Distribution
Public keys travel in hierarchical signed lists that verifiers sync periodically.
Rotation
Certificates are renewed before expiry; older ones still verify the seals they signed.
Revocation
A compromised certificate is disabled through CRL or OCSP.