To be sure, the U.S. government and lots of other governments already have PKI-based systems in place to handle the single-axis space they’ve developed in NIST SP 800-63. (Whether revocation is handled properly in those systems, I don’t know…) But the richness of the types of confidence really needed in the wild — that is, not just in government applications but others — suggests that more is needed. We’re certainly finding that to be true in the UMA work, where we’re trying to do data-sharing terms negotiation through a freshened-up “claims” mechanism. (More on that very shortly. Hey, Rich, we could use you on the team!)

And in the meantime, many web developers push back on doing the tiniest bit of crypto, which makes it awfully hard to achieve even the sorts of security and confidence we know how to do pretty well. (See Ben Laurie’s recent lament about WRAP on this score.)

Paul– My mouse did hover over the “Venn” category button for a moment, but it seemed too impure to get away with. ;-) By all means, have at it…

As far as attributes go: authoritativeness is really consumer dependent – in many cases the authority of a source may be perfectly acceptable for a given consumer, while not at all acceptable for another. A better concept here might be “data originator”, i.e. the original author of some data. If you use this concept, you can build on (context dependent) reputation schemes for the data originator (who might actually an aggregator or deriver of data). I find this overall easier than introducing yet another artificial concept such as “authoritativeness”.

paul