This guest post reflects the views of the author and does not necessarily represent the views of KuppingerCole Analysts. It is provided for informational purposes only and should not be interpreted as independent research, analysis, endorsement, or advisory services by KuppingerCole Analysts.
I was part of a pilot for Immigration, Refugees and Citizenship Canada with a simple requirement: a digital work permit still had to be verifiable after it was printed.
Our first approach placed an entire W3C Verifiable Credential inside a QR code. Cryptographically, it was attractive. Physically, it was not. The code was difficult to print reliably and difficult for ordinary phones to scan.
The pilot exposed a larger assumption. Most digital identity programmes begin with a smartphone wallet and treat paper as a fallback. But people may share devices, rely on intermittent connectivity, or access services through an employer, agent, kiosk, or government counter.
A printed, verifiable document reverses the burden. The holder carries paper; the verifier supplies the technology. Identity systems should not fail when a citizen lacks a compatible, charged, connected device.
Why the Timing Is Different Now
The standards have reached a point where this alternative can be designed seriously. The W3C published Verifiable Credentials 2.0 as a web standard in May 2025. CAWG’s Identity Assertion Specification 1.2 was ratified by the Decentralized Identity Foundation in December 2025. C2PA 2.4 also defines mechanisms for retrieving manifests using an identifier, a soft-binding value, or an asset.
This coincides with expanding wallet programmes. KuppingerCole Analysts has examined both what it will take to make the European Digital Identity Wallet a business success and why trust in wallet-based digital identity still has to be earned.
Printed verification should be designed alongside wallets before wallet-only assumptions become embedded in public-sector architecture. The opportunity is a hybrid model: a citizen can use a wallet when one is available and still present a verifiable physical document when it is not.
Identity leaders must decide what the paper carries, how the signed data is retrieved, and which component is trusted to display the result.
How C2PA and CAWG Divide the Trust Problem
C2PA (Coalition for Content Provenance and Authenticity) is best known as the technical foundation for Content Credentials. It assembles signed assertions into a manifest and binds that manifest to a digital asset. The manifest can record what happened to the asset, which ingredients were used, and which hardware or software produced the claims.
CAWG (Creator Assertions Working Group) adds an identity layer. Its identity assertion allows a credential holder to prove control over a digital identity and associate a named actor with selected assertions in the C2PA manifest.
For a government document, that actor could be the issuing authority. A CAWG identity assertion could bind an immigration authority’s organisational identity to the manifest and the claims it endorses. This makes the relationship attributable but does not automatically establish trust. A trust framework must define which issuers and credentials are authoritative for work permits.
Three relationships must remain distinct.
First is issuer authentication: evidence that the claims were authorised by the issuing authority.
Second are the subject’s claims, such as name, permit number, conditions, and expiry. C2PA and CAWG do not define a work-permit data model, so these fields require an application-specific assertion or embedded credential.
Third is presenter-to-subject binding: evidence that the person holding the paper is the person described by it. The manifest alone cannot establish this. A verifier may need to compare a signed portrait, inspect another identity document, or request a wallet-held credential.
C2PA and CAWG can make a document attributable and tamper-evident. They do not eliminate the need to connect issuer, claims, paper, and presenter.
Why the QR Code Should Carry a Pointer
There are two basic QR-code models.
In a payload model, the code contains the signed credential. This can support offline verification when the verifier has the required schemas, keys, and trust material. Its weakness is density, which undermined our pilot.
In a pointer model, the QR code carries a compact identifier or URL. The verifier uses it to retrieve the manifest and validate the signed information. The C2PA Soft Binding Resolution API supports retrieval using a manifest identifier as well as soft-binding values and assets.
The QR code is therefore a discovery reference, not proof. Proof comes from validating the manifest and matching its signed claims to the document.
A pointer keeps the code small while allowing the manifest to contain more information than a practical QR code can hold. Live retrieval can also support current status checks. A revoked permit could fail a later scan when a repository or status service exposes the change and the validator applies the correct policy.
That outcome is not automatic. Resolution requires a defined status mechanism, current status data, and validator behaviour that handles revocation appropriately. A payload can also reference an online status service, although that reduces its offline independence.
The Risks: Copying, Surveillance, and False Verification
A QR code can be copied perfectly. Place a genuine permit’s code on a forged document and it may still retrieve a valid manifest. If verification stops at “the signature checks out,” the forgery wins.
The signed data must therefore be bound to the page’s visible content: the permit number, name, conditions, expiry, portrait, or a canonical representation of those fields. The verifier must confirm that the paper matches what the authority signed. A conventional hash of the original PDF is insufficient because printing, scanning, scaling, and wear change the bits without necessarily changing the meaning.
The human workflow creates another risk. A dedicated validator can retrieve the manifest, validate signatures, evaluate trust, check status, and display the claims. A standard phone camera may instead open a webpage. That page can explain what was found and direct the user to a validator, but it must not become the source of the trust decision.
If it does, a malicious QR code could display an official crest and a green “verified” message without performing conformant validation. Teaching people that “scan and trust the webpage” equals verification would recreate a familiar phishing pattern.
Live resolution also creates a privacy trade-off. Every scan may reveal that a document was checked, when, and potentially where or by whom. The World Privacy Forum’s analysis of C2PA and CAWG highlights risks involving identity, correlation, surveillance, and governance.
For a movie poster, scan telemetry is analytics. For an identity document, it may become surveillance.
What Identity Leaders Should Do Now
Identity leaders should prioritise five decisions.
- Define the trust framework first. Specify which issuers, certificate authorities, identity aggregators, repositories, and status services are trusted—and for which document types.
- Separate discovery, validation, and presentation. The QR code locates signed information. The validator performs cryptographic and policy checks. The interface explains the result without treating a webpage or logo as proof.
- Specify the paper-to-manifest binding. Decide which visible fields are signed, how they are compared with the document, and how photocopies, substitutions, damaged pages, and reprints are handled.
- Minimise resolution telemetry. Document what the repository logs, avoid stable identifiers where possible, separate status checking from unnecessary tracking, and assess privacy-preserving or distributed resolution.
- Design for degraded connectivity. Define which trust lists and status data may be cached, how long they remain acceptable, and when a verifier must refuse, defer, or escalate a check.
Digital wallets remain essential, but they should not be the only route to verifiable documents. The printed path works in layers: discovery through the QR code, provenance through the C2PA manifest, attribution through the CAWG identity assertion, and permit data through an application-specific assertion, with the validator applying cryptographic and governance-based trust across all of it. Only the final judgement is human, connecting those claims to the paper, and the paper to the person presenting it.
Public-sector identity programmes should treat printed QR references as a first-class architectural option. The future of digital identity is unlikely to be paper or wallet. It will be a hybrid system that keeps working when one half of it is unavailable.
