Digital Identity 101

What is a DID?

The identity behind every verifiable document — a W3C standard, and a lot simpler than it sounds.

This is the short primer. For the full technical story — the .vrfy sidecar, the Triangle of Trust, and how checking works end to end — read How TrustDID works. For the plain-English version of why any of this matters, read Why TrustDID.

The simple explanation

A DID is just a web address that points to a small text file containing public cryptographic keys. That's it.

Think of it like a business card on your own website. Anyone can look it up, it tells people how to check documents you've sealed, and it stays completely under your control.

How it works

  1. Create a simple JSON file. 
    {
  "id": "did:web:trustdid.ca",
  "verificationMethod": [{
    "id": "did:web:trustdid.ca#sign-key",
    "type": "Ed25519VerificationKey2020",
    "publicKeyMultibase": "z6Mk..."
  }]
}
  2. Put it on your website.

    https://trustdid.ca/.well-known/did.json

  3. Anyone checks it using TrustDID software. Patent pending

    It runs on their computer, fetches your public DID, and checks the document locally — no uploads, complete privacy.

Why this design works

It's just a file on your website
  • No blockchain required
  • No special infrastructure
  • No third-party services
  • You already have DNS and web hosting
Checking is completely private
  • TrustDID software runs on the checker's own computer
  • Documents stay on their machine
  • No cloud uploads, no third-party servers
  • Your business keeps complete sovereignty over your data

Scaling examples

Startup (5 people)

example-startup.ca/.well-known/did.json

One signing key for the whole company

Growing company (50 people)

trustdid.ca/.well-known/did.json trustdid.ca/finance/ trustdid.ca/legal/ trustdid.ca/hr/

One DID per department

Enterprise (1000+ people)

example-enterprise.ca/ example-enterprise.ca/divisions/manufacturing/ example-enterprise.ca/divisions/sales/ example-enterprise.ca/divisions/sales/west/

Hierarchical DIDs matching your org structure

Same structure as your DNS, same hierarchy as your organization chart. IT administrators already understand this.

What goes in the DID document?

Public cryptographic keys (safe to publish)
  • Signing key — used to create document signatures
  • Encryption key — used so others can send you encrypted files
Nothing secret (never include)
  • Private keys — you keep those on your own computers or HSMs
  • Passwords
  • Confidential business data

The beauty of simplicity

To start using TrustDID, you need:
  1. A domain name (you already have this)
  2. Web hosting (you already have this)
  3. TrustDID software to seal, encrypt, and check files Patent pending (this is what we provide)

That's it.

No blockchain. No complex infrastructure. No vendor lock-in. No cloud uploads. Complete sovereignty.

A real-world example

Before TrustDID

Finance team sends invoice.pdf by email

→ Recipient calls: "Did you really send this?"

→ Manual verification, phone tag, delays

After TrustDID Patent pending

Finance team sends invoice.pdf + invoice.pdf.vrfy

→ Recipient runs TrustDID on their own computer

→ TrustDID fetches trustdid.ca/.well-known/did.json

→ The check happens locally — no uploads, complete privacy

✓ Sealed by the trustdid.ca finance department

No phone calls, no manual verification, no doubts, no privacy concerns.

What a .vrfy manifest looks like

When you seal a document with TrustDID, it produces a .vrfy file — a verification manifest that travels alongside your document. Here is a real example:

{
  "version": "3.0",
  "type": "VerifiableDocumentSignature",
  "did": "did:web:trustdid.ca",
  "payload": {
    "did": "did:web:trustdid.ca",
    "documentHash": "447de134b08fca5437616682...",
    "hashAlgorithm": "SHA-256",
    "timestamp": "2026-03-06T19:12:21.004129Z",
    "fileName": "invoice-2026-0042.pdf",
    "fileSize": 184320,
    "mimeType": "application/pdf"
  },
  "proof": {
    "type": "Ed25519Signature2020",
    "verificationMethod": "did:web:trustdid.ca#finance",
    "proofPurpose": "assertionMethod",
    "proofValue": "OTtDcAfrnoVM7VaHKN7gdxv5..."
  },
  "manifestProof": {
    "type": "Ed25519Signature2020",
    "verificationMethod": "did:web:trustdid.ca#finance",
    "proofPurpose": "authentication",
    "proofValue": "sVdHbihSLaO8QG+Jits8Kkx..."
  },
  "pqManifestProof": {
    "type": "MLDSASignature2024",
    "verificationMethod": "did:web:trustdid.ca#finance-pq",
    "proofPurpose": "authentication",
    "proofValue": "L5R9Uy3Qtt7U1R/jYLMgDG3..."
  }
}
Three layers of cryptographic proof in every seal:
  • proof — Ed25519 signature over the document hash (proves who sealed it)
  • manifestProof — Ed25519 signature over the entire manifest (prevents tampering with the .vrfy file itself)
  • pqManifestProof — ML-DSA-44 post-quantum signature (quantum-safe from day one, enabled by default)

Common questions

Don't I need a blockchain for "decentralized"?

No. Your website is already decentralized — you control it, not some central authority. DIDs just formalize where to put your public keys.

Do my documents get uploaded anywhere during a check?

Absolutely not. TrustDID runs entirely on your computer. It only fetches the public DID from the sender's website. Your documents never leave your machine. This is fundamental to sovereignty.

Can I change my keys?

Yes. Just update your did.json file. Old signatures remain valid because they are timestamped; new signatures use the new key. It works like rotating a password.

Do I need different keys for different departments?

Only if you want separation of signing authority. One company, one key is fine. Or one key per department. Or one per employee. Your choice, and it scales to your needs.

Technical, but not complicated

The crypto is strong — and quantum-safe:
  • Ed25519 signatures (used by SSH, Signal, age encryption)
  • X25519 encryption (used by WireGuard, Signal, TLS 1.3)
  • ML-DSA-44 post-quantum signatures (NIST FIPS 204 standard) — enabled by default on every seal
  • The same cryptography securing modern internet infrastructure, plus quantum readiness built in
The deployment is simple:
  • Upload one text file
  • Put it at /.well-known/did.json
  • You're done
The software is sovereign Patent pending
  • TrustDID runs on your computer
  • All sealing, encryption, and checking happens locally
  • Your documents never touch a third-party server
  • Complete privacy and control

Bottom line

A DID is just a standardized way to publish your public cryptographic keys at a predictable web address.

TrustDID software Patent pending handles the sealing, encryption, and checking — locally on your computer, never uploading your documents anywhere.

No blockchain. No complexity. No cloud uploads. Just files on your website that tell the world "here's how to check documents from us."

It works for a solo consultant. It works for a Fortune 500. Same technology, same simplicity, different scale.

That's the beauty of building on the web.

Ready for the full story?

The math tells you it's genuine — people tell you whether to trust it. See how the two fit together.

Try the Live Demo How TrustDID Works