Utah Blazes New Trail for SSI: SEDI
Finally!
On March 4, 2025, the Utah legislature unanimously passed SB 260, a groundbreaking digital identity bill that carries this description:
“This bill enacts provisions related to a state-endorsed digital identity” (SEDI).
Now it’s off to the governor for signature, who has been publicly positive about it. Huge credit to Sen. Cullimore, the bill’s sponsor, and Christopher Bramwell, the state’s Chief Privacy Officer, who helped draft and guide its content. SB 260 will likely soon become the law in Utah, and with it the possibility of an exciting new era for self-sovereign identity (SSI).
Passage of SB 260 is the partial realization of a dream I’ve had for more than a dozen years, since co-founding Evernym with Jason Law in 2012. It is not the complete realization of that dream, but it lays the necessary groundwork and carries with it momentum to go the distance over the next few years.
SB 260 does not call for the creation of a new identity system for the state of Utah — yet — that will be done later, hopefully in next year’s session. This bill establishes the principles Utah politicians stand behind — unanimously — that any future Utah statewide identity system must adhere to. If you are an SSI aficionado, you will recognize and love the principles in this bill.
Is State-Endorsed Identity (SEDI) Still SSI?
For some in the SSI community, the concept of SSI does not involve a state actor — at all.
To these SSI purists, SSI becomes trustworthy through a web of trust that replaces the need for a state actor as a root of trust. While theoretically possible — and still a worthwhile end-goal — this ideal vision of SSI isn’t feasible anytime soon. In the meantime, the credibility of government can help accelerate SSI toward an end-goal of not needing government. How? By making ubiquitous the technologies and ceremonies necessary for a web of trust to emerge.
At the end of the day, if independent control of strong digital identity rests fully with the individual, with no visibility by the state for if, how, or when it is used, then advocates of SSI should be in favor of SSI strengthened by a state endorsement. That is how physical identity works today and how digital identity should work, too. And there’s no reason other, non-government flavors of SSI can’t continue to develop and coexist.
State-Endorsed Digital Identity (SEDI)
The words “state-endorsed” used throughout this bill carry a lot of meaning; most emerging digital identity systems use the word “issue“ instead of “endorse”. This is a distinction with a profound difference.
In real life, does a state issue identity or endorse it? When a baby is born, who gives the baby its identifier, its name? The parents do. The state waits for parents to pick a name, puts the name into a certificate, endorses the certificate, then gives it to the parents. Parents determine identity, the state endorses it.
A couple months ago, a 60 year-old friend of mine decided to change her last name. The decision was hers alone to make, but her new name would not be believable or provable to third parties until she has an endorsement of the new name from the state.
In real life the state issues credentials, not identity. In this bill Utah acknowledges this reality and explicitly states that individuals first assert identity and only then can the state endorse it. That will be the guardrails for any future state-endorsed digital identity system. (See “SEDI Details for Identity Nerds” for more info.)
Through SEDI, SB 260 codifies several foundational SSI principles:
Control
In lines (65) and (120), it is explicit that the individual is in control of their digital identity.
Guardianship & Age Verification
Lines (35–40) and (97–98) lay the groundwork for digital guardianship, bringing broad digital capabilities for the first time to dependent populations such as children (including infants), the elderly, disabled persons, homeless persons, and more
Of particular note in Utah, digital guardianship is how age verification can work for all ages and capabilities, something Utah has been on the forefront of, policy-wise. In the future, guardianship could even work for animals and things, too.
See “Finally, a Path Forward for Age Verification” by the Libertas Institute for more info about how SB 260 could facilitate age verification.
Privacy & No Surveillance
SB 260 is explicit that individuals have the right to not be surveilled. This means that SEDI cannot have any form of “phone home”, which differentiates it from the mobile drivers license (mDL) systems based on ISO 18013, and from the federated identity systems now being implemented in Europe and Australia, which all have inherent phone-home surveillance capabilities.
In lines (78–79), (84–96), (99–102), (116–117), (122–125), and (128–139) the bill details the principles of privacy and autonomy that must guide any future state-endorsed digital identity system in Utah.
State-of-the-Art Security
Line (113) stipulates that Utah SEDI must incorporate “state-of-the-art safeguards” for protecting identity. Current industry standards are not good enough, and in fact are unacceptably fragile in my view. My interpretation of “state-of-the-art” means something akin to KERI (Key Event Receipt Infrastructure), where breaches are preventable, detectable, and recoverable in ways that current identity standards cannot do, and which is quantum-resistant. (See the ‘Details for Nerds’ for more details about security.)
Now the Work Begins
In some ways SB 260 is the end of a long, hard journey for me, and the partial realization of an audacious dream. In reality it’s one bill, in one state, that establishes the principles and guardrails for a future identity system without creating one today.
In any case, it’s the closest thing I’ve seen to true self-sovereign identity being officially and legally embraced at a significant level, an entire state of the United States. The next step is far harder: turning concepts into reality.
Stay tuned.
For more technical information, see SEDI Details for Identity Nerds.
