Across Europe, national and sectoral pilots are deploying digital identity wallets under the eIDAS2 framework. The leading solutions for credentials, wallets, and Zero Knowledge Proofs are all based on open standards. Learn from real-world pilots how these standards are securing academic networks, press freedom projects, legal persons, and cross-border projects (beyond Europe). Attendees will learn what it takes to design wallet systems that remain open, transparent, and adaptable.
Open Solutions leading the EU Digital Identity Wallet Pilot Programs [Introductory]
May 21, 2026
Video Description
Short Summary
Interesting Facts
Notable Quotes
Recommendations
Takeaways
Nineteen years after founding Yubico to pursue “one single login to all of the internet” and co-creating the FIDO authentication standard with major tech companies, the founder returned to Sweden and became deeply involved in Europe’s Digital Identity Wallet program. A year ago, she established Cirrus Foundation as an independent non-profit to help build an open identity platform intended not just for Europe but globally, aligned with Europe’s cross-border goal of giving users control over their data by sharing only what a service needs—sometimes merely proof of being a verified human rather than a bot.
A workable digital identity system is framed as requiring four demanding, competing properties: security, usability, privacy, and scalability. The approach argues against building only for phones, since that excludes significant global users and use cases, and instead promotes combining open standards: FIDO passkeys (as more than authentication—an API spanning the identity ecosystem), hardware security modules (HSMs) and signature services, and zero-knowledge proofs for privacy-preserving claims such as age verification and offender blocking.
To demonstrate feasibility, Yubico, Cirrus, and open research partners built a prototype called WWWallet, which succeeded in early European wallet pilots and won a “Sprint Funky” competition. Cirrus then evolved the prototype into a more fully fledged credential platform now used in multiple pilots: “Aptitude” with France and Canada for cross-border student and workforce mobility; “WeBuild” as a business wallet enabling transfer or delegation of access (positioned as easier with passkeys than phone-only approaches); and a Sweden–Singapore pilot for cross-border business interoperability such as establishing a company branch.
Adoption is also described outside government wallet pilots: eduGAIN (a global federation of about 10,000 universities and 3 million users) selected the technology due to being open, global, and open source for ongoing development by research communities. OCCRP (an investigative journalism network) is using the platform to create a global digital press pass for secure, privacy-preserving communication, particularly for journalists at risk who may not be able to travel with phones or computers but can conceal a FIDO security key. Additional engagements include interest from a country where phones are shared among family members—making phone-only identity impractical—and work with a child-safety-focused global collaboration on privacy-preserving age verification and known-offender blocking, including addressing security concerns raised about a recently launched European age verification app.
The foundation’s mission is positioned as neutral facilitation of collaboration among tech companies, researchers, innovators, and governments, with the claim that standardizing and productionizing zero-knowledge proof methods and expanding FIDO as a unifying API across secure elements (in phones, computers, keys, and cards) can help reach “100% of users and use cases,” reduce dependence on HSM-only infrastructure, and scale globally. In Q&A, a potential use case is suggested for people who have lost identity documents: issuing temporary identity via a FIDO-enabled card or token through shelters, alongside an openness to further collaboration on issues such as helping vulnerable populations, including stolen children.
- Yubico was founded 19 years ago with the vision of enabling a single login for the internet.
- A FIDO authentication standard was co-created in collaboration with major technology companies.
- Cirrus Foundation was founded as an independent non-profit to help build an open identity platform intended for global use.
- Europe’s digital identity wallet vision includes a cross-border identity solution aimed at giving users control over their data.
- WWWallet was developed as a prototype by Yubico, Cirrus, and partners in an open research community.
- WWWallet showed early success in European digital identity wallet pilot programs and won a “Sprint Funky” competition.
- A pilot called Aptitude involves France and Canada for cross-border student and workforce mobility.
- A business wallet initiative called WeBuild focuses on delegating or transferring access to another person.
- A Sweden–Singapore pilot is underway to demonstrate cross-border interoperability for business use cases such as setting up a company branch.
- eduGAIN is described as a global federation of 10,000 universities and 3 million users.
- “one single login to all of the internet.”
- “Europe has a bold, beautiful vision.”
- “The users will share only the data needed for the service.”
- “four demanding and competing requirements. Security, usability, privacy, and scalability.”
- “If we only build solutions for phones, it’s not going to work for 100% of the users and use cases globally.”
- “we developed a prototype that we named WWWallet.”
- “they choose our technology because it’s fully open, it’s global, and it’s open source.”
- “what they can bring is a FIDO security key that they hide in their pocket.”
- “Serial knowledge proof… can help solve the challenge with age verification, offender blocking.”
- “create one single API across the whole digital identity ecosystem.”
- Prioritize architectures that work on the web and shared devices, rather than assuming every user has a personal smartphone.
- Implement minimal disclosure by default so services receive only the precise attributes required (including “verified human” proofs).
- Treat security, usability, privacy, and scalability as explicit design tradeoffs and validate them through pilots early.
- Use FIDO passkeys as a standardized interface spanning authentication and secure signing flows across devices and form factors.
- Combine hardware-backed security (HSMs/secure elements) with privacy-preserving proofs to avoid over-collecting personal data.
- Build modular identity platforms that can meet differing regional requirements (e.g., Canada vs. Europe) without redesigning the core.
- Include delegation/transfer workflows (especially for businesses) as first-class features rather than bespoke add-ons.
- Support high-risk and low-connectivity contexts by enabling portable credentials (e.g., security keys or cards) that don’t require phones.
- Keep core components open source to allow large federations and research communities to extend and audit the system.
- Standardize and productionize zero-knowledge proof approaches for sensitive use cases like age verification and offender blocking.
- A global digital identity wallet must work beyond phones to cover shared-device and no-phone populations.
- Achieving practical digital identity depends on balancing security, usability, privacy, and scalability simultaneously.
- FIDO passkeys can be elevated into a unifying API across identity and security hardware, not just a login mechanism.
- Open standards plus open source can accelerate cross-border interoperability across education, workforce, business, and journalism use cases.
- Privacy-preserving proofs are positioned as essential for claims like age verification and “real human” checks without revealing extra data.
Downloads
Hide Transcript
Show Transcript
Hello everyone, late in the afternoon. 19 years ago, I founded Yubico with a simple vision, one single login to all of the internet. And to make this vision happen, my co-founder and I, we moved to Silicon Valley and we worked with the tech giants and we co-created a FIDO authentication standard. Three years ago, I moved back to Sweden and started to engage in the European Digital Identity Wallet Program. And one year ago, I founded Siros Foundation as an independent non-profit to help build an open identity platform, not only for Europe, but for the world.
So, Europe has a bold, beautiful vision. One common identity solution, cross-border, to help users to get in control of their data. And on a high level, the user, you know, the credentials will be transferred to an app on a phone or a computer. The users will share only the data needed for the service that in some cases may just be that you are a verified human and not a bot.
And today, with more fake identities and bots on the internet, we want this vision to happen. And the challenge.
Well, building a digital identity system that actually works requires to ensure that you have four demanding and competing requirements. Security, usability, privacy, and scalability. It's not going to be easy, but we think it's possible.
If we, looks strange here. If we focus on the web, if we only build solutions for phones, it's not going to work for 100% of the users and use cases globally. And if we build it on the FIDO-PASC standard, not only as an authentication method, but as an API that will connect with HSM and signature services. And CKP as the solution for privacy. And we accept this challenge. And to demonstrate the power of all these three technologies, open standard technologies, we, Yubico, Cirrus, and our partners in the open research community, we developed a prototype that we named WWWallet.
The WWWallet prototype showed success in the early European digital identity wallet pilot programs. And we were selected as one of the winner in the sprint funky competition. And then Cirrus Foundation stepped up and took the prototype and built a more sophisticated, a more fully-fledged identity credential platform. And we're now engaged actively in the new pilot programs. We build an aptitude. And in aptitude, we're working with France and Canada for cross-border student and workforce mobility. And they choose our solution because in Canada, they have other requirements than Europe.
They need this system to work for them. And we built our solution as a modular platform that is not limited to Europe. With WeBuild, we created a business wallet enabling an easy way to transfer or delegate access to another person. And this is not easy to do with a phone, but it's easy to do with Fido pass keys. And similar use case, independent of the European programs, we have started a pilot with Sweden and Singapore to demonstrate cross-border interoperability of business use cases, setting up a company branch and other things. We're also collaborating with Edugane.
Edugane is an international, global federation, 10,000 universities, 3 million users. And they choose our technology because it's fully open, it's global, and it's open source. So they can continue to develop it in their global research community. This is one of my favorite.
OCCRP, the world's largest network of invested journalists, they are using this identity platform that we've built to build a global digital press pass that will enable secure and privacy preserving communication for journalists who are at risk today, but mainly actually for the journalist who needs to travel between countries and cannot bring a phone or a computer, because that could mean their life. So what they can bring is a Fido security key that they hide in their pocket. We've just been approached by a country outside Europe, where a part of the population doesn't have their own phone.
Phones and computers are shared among family members. So they cannot build a system based on phones only. And we have also just engaged with a global collaboration, like a non-profit organization focused on child safety. And what they want help with is age verification and known offender blocking on the internet. And this is where serial knowledge proof comes in. The European age verification app that was recently launched has raised concern on security that we think that we can help solve.
Serial knowledge proof, developed and evolved in the right way, can help solve the challenge with age verification, offender blocking, and any other application where we need to prove it's a real verified human, but we don't want to disclose any more information. We are working with, I'm going back to that slide, we're working with the tech giants and countries in other countries to ensure that serial knowledge proof becomes standardized and ready for production. And Serious ID has demonstrated implementation of Google Longfellow and BBS.
So I'm emphasizing FIDO, not only because it's the only authentication technology that's proven to stop account over at scale, but it's also an opportunity to create one single API across the whole digital identity ecosystem. HSMs, security built into phones and computers, security keys into security keys, I'm sorry, secure elements in security keys, secure elements in thin cards, and that will be one interface to rule them all.
And yes, Europe is starting now on HSM, but we are building for the second phase, where this is a reality and we can cover 100% of users and use cases, and we can scale globally to the countries where everyone don't have a phone. And we will also be able to build infrastructure that will be less costly than dependent only on HSMs. So Serious Foundation was set up as a neutral collaboration effort, where we facilitate dialogue and collaboration between tech giants and researchers and innovation companies and countries.
And we welcome collaboration, because this is a really hard and really important mission. Europe is going to help save democracy and make the internet safer for all. Yes. Thank you. I think then there's left time for questions. So I think we saved four minutes. So are there any questions in the room over here already? I have a microphone here and can give it to you.
Sorry, I lost my voice a little bit, but Stina, first of all, as Ukrainian, thank you very much from all of us. 50,000 keys given, 2022, constant support of Ukrainians. It's amazing what you're doing. Thank you. That was from Yubico, not Serious, but thank you. But for the Serious, we have a lot of problems with stolen children. And we're trying to figure it out the way I'm working directly with some organizations helping out. What you're doing right now probably will help to restore an ability to create the identities of people or not even ability to do identities.
Do you think that your organization will be helped to do this great mission and, you know, get the voices of people who cannot speak for themselves? Yes. Yes. What would be your vision to do something like that? You know the problem. I don't need to describe it. Thank you.
I mean, in sometime places where you've lost your identity, you lost your passport, you can come to a shelter where you'd be given a temporary identity. That may be a little Fido enabled card or token. And you can say this works temporarily. That's an option. But there are more.
I mean, I would be happy. That would probably, you know, be another session. But reach out to us and we will ensure that we address the problem in our next blog. So any more questions there? So we still have some time for questions. Maybe also to the people in the online stream, you can raise questions in the applications and we'll see them here. So any more questions from the audience to Stina? That seems not to be the case.
So yeah, then let's wrap it up with that. Stina, thank you very much for being on the stage here. Take care and bye bye. And then we prepare for the next presentation. Thank you very much.
