How a wallet provider proves, again and again, that each wallet unit and its keys still deserve their assurance level.
A wallet provider builds an EU Digital Identity Wallet. Many phones lack a certified secure element, so user keys live in hardware security modules in a data centre, and the app on the phone unlocks them.
The Wallet Unit Attestation says: this app instance is genuine and its keys are in certified hardware. That was true at activation. Since then the phone took two system updates, the app was updated, and one user rooted their device. On the server side, the HSM firmware was patched and a node was replaced.
Short validity for the Wallet Unit Attestation, with renewal that requires fresh device evidence. Revocation that reaches the credentials issued on top of it. Remote attestation of the HSM and of the service in front of it, so the key attestation is backed by hardware evidence. A table of events and the response to each: update, root detection, loss, firmware flaw in a phone model.
A certification file that describes a living system, and issuers and relying parties who can check the wallet instead of assuming it.
An illustrative case built from public documentation and common architectures. It describes no particular company.
Working on attested wallets and digital identity? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.