2026-09-07 · Gustav Poola
The Vocabulary of Trust Is Broken. Here's a Repair Kit.
The words we use in digital identity are load-bearing. Use the wrong one and the listener walks confidently down the wrong road — and in identity, security, and compliance, most of our everyday words send people the wrong way. This is the eleven-point vocabulary repair kit for anyone building identity infrastructure: data vs information, trust vs proof, authentication vs identity, permission vs authority, compliance vs evidence, disclosure vs predicate. If our language keeps reaching for words that can't be measured, are we building resilience — or performing security?
Read more →
2026-09-06 · Mairi Kutberg
How Do You Verify a Remote Hire's Identity When You've Never Met Them in Person?
You verify the passport chip — remotely, in ninety seconds, with cryptographic evidence signed by the state that issued the document. The engineering answer for a remote-hire identity check without an in-person meeting is chip-anchored NFC read plus biometric face-match against the chip photo, wrapped in an AdES record retained under a Long-Term Validity envelope. This post walks the pattern for full-time employment remote hires (distinct from gig workers and contractor-of-record engagements), the four questions the pattern actually answers, and where the picture is genuinely harder than the identity layer alone.
Read more →
2026-09-03 · Gustav Poola
How Do Multiple Parties Sign the Same Document Digitally?
Multi-party document signing takes one of two shapes — sequential (party A signs, then B, then C, each signature depending on the previous one) or parallel (all parties sign the same document independently, with an aggregator collecting and combining the signatures). Both are supported cleanly by the eIDAS AdES formats (PAdES, XAdES, CAdES) but the cryptographic semantics, the timestamp coordination, and the LTV envelope requirements differ meaningfully between them. This post walks the two patterns, when to use each, and what tends to break when the pattern is chosen wrong for the workflow.
Read more →
2026-08-30 · Mairi Kutberg
How Do You Verify a Gig Worker's Identity Without Re-KYC on Every Task?
You do not — you verify once, chip-anchored, and reuse the record across every subsequent task engagement with a lightweight activation step (biometric touch, PIN, or device unlock) that binds each task to the same verified person. The engineering pattern is reusable identity anchored at first-verify and retained under an AdES evidence envelope that survives well beyond any single task lifetime. This post walks the pattern, the three architectural properties that make it survive a compliance review, and where the picture is genuinely harder than the marketing suggests.
Read more →
