Across the trust-infrastructure reviews, a consistent distinction emerges between evidence that can be verified and authority that can be relied upon. Cryptographic signatures, identifiers, registry entries, provenance chains and credential formats make facts inspectable. They do not, by themselves, establish that an issuer was entitled to make a claim, that a relying institution is entitled to use it, or that a particular purpose justifies the resulting action.
*A Verifier-Centric Conceptual Model for Digital Credential Ecosystems* makes this boundary explicit by separating signature verification, semantic interpretation and validation. Its Constitution and Logistics planes show that interoperability depends on both shared rules and access to the material needed to apply them. The verifier still bears responsibility for which trust anchors, policies and declarations enter the acceptance decision. *Credential Disclosure in EU Digital Identity Wallets* adds a distributional dimension: relying parties can exercise power through what they request and what they treat as necessary for service.
The authority-continuity papers approach the same problem from execution lineage. Provenance-bounded execution can prevent downstream privilege expansion and preserve causal continuity, but it does not establish the legitimacy of the authority at the origin. The later continuity model protects an important invariant, yet the institutional acts that create, renew, revoke or dispute authority remain external governance questions.
*Designing Agent IDs* shows how the same category error reappears in emerging agent infrastructure. Identity and provider metadata can make an actor legible to a service, but lifecycle authority still depends on scope, freshness, revocation, conflict resolution and the governance of registries and resolvers.
The national digital trust architecture review brings these strands together at institutional scale. Its strongest move is to make the Trust Decision explicit: issuer authority, provenance, validity, purpose, relying-party authority and responsibility must all be evaluated before service action. The proposed registry is therefore not the source of trust itself. It is evidence infrastructure supporting a governed reliance decision. The sharper review also fixes the contribution boundary: this is a strong governance blueprint, not yet deployable national trust infrastructure, because legal authority, registry operation, liability and cross-sector redress remain unresolved.
Taken together, the archive supports a durable proposition: trust infrastructure is not merely infrastructure for proving origin; it is infrastructure for making and auditing legitimate reliance decisions. The governance burden therefore sits as much with relying institutions, registry operators and policy authorities as with issuers. A technically interoperable trust layer remains institutionally incomplete if those decision rights and liabilities are only implied.
The remaining questions concern the institutions behind the infrastructure. Who may admit or suspend an issuer? How are conflicting authority sources reconciled? What appeal exists when registry state is wrong? How does a relying institution prove that its own use was authorised for the stated purpose? Cross-border recognition further requires governance arrangements that technical interoperability cannot supply on its own. The material next evidence is therefore institutional: a pilot should demonstrate operator mandate, conflict resolution, liability, correction and redress, not merely successful verification.
Traceability
This synthesis is a human-edited analytical artifact produced with AI/LLM assistance under `AI-USAGE.md`. Its claims are grounded in the constituent reviews listed in front matter and should be read through those reviews and the underlying papers.