The registrar's signature: credential issuance authority in an age of instant fakes
Generative tools made a convincing transcript a five-minute job. Verification did not get any faster: it still means asking the institution, which means the institution has to exist, answer, and be the institution you think it is.
Who is authorised to issue a credential, and how would a verifier know?
A registrar, under delegated institutional authority — recorded nowhere a verifier can reach. Credential fraud has moved from forging documents to compromising or impersonating the issuance function, and a verifier checking a credential has no way to test whether the issuing authority was real.
- Verifiable credential ecosystems verify an institutional key. They rarely bind the registrar's specific issuance act, which is what an authority question actually asks.
- Complexity has been the adoption barrier: full decentralised identity stacks impose a wallet, a resolver and a trust registry on every party.
- An issuance receipt is a narrower construct — registrar signature plus institutional countersignature, verified offline — and trades ecosystem generality for deployability.
Part of Education and credential identity
Two different questions
When an employer verifies a degree they are asking two things and usually cannot distinguish them.
- Did this institution issue this credential? — an institutional question.
- Was it issued through a proper act by someone with authority? — an issuance question.
Paper conflated them, because a sealed transcript signed by the registrar answered both at once. Digital verification has mostly answered the first and dropped the second, and the drop is invisible because nobody separated the questions to begin with.
What current approaches verify
| Approach | Verifies | Requires | Survives institution changing systems? |
|---|---|---|---|
| Clearinghouse lookup | That a record exists in a central database | Membership, network access | Yes, if the clearinghouse persists |
| Secure PDF transcript | That a file came from an institutional key | Reader support for the signature | Uncertain — certificate expiry |
| W3C verifiable credential | A credential issued under an institutional DID | Wallet, resolver, trust registry | Depends on DID method persistence |
| Issuance receipt | The registrar's act and the institution's countersignature | A published key | Yes — offline verification |
Row three deserves a fair hearing. Verifiable credential ecosystems are more capable than what is proposed here: selective disclosure, holder-controlled presentation, revocation registries. They are also, empirically, hard to deploy, because they require every relying party to adopt infrastructure.
The complexity comparison, honestly
An employer verifying a degree should not have to run anything. That constraint eliminates most of the design space.
| Approach | Relying party must have |
|---|---|
| Clearinghouse | An account and a budget |
| Verifiable credential | Wallet software, a DID resolver, a trust registry policy |
| Issuance receipt | A published key and a signature check |
The last row is deliberately austere. It gives up holder-controlled selective disclosure, which is a real loss, in exchange for verification by anyone with no infrastructure. For the credential-verification use case specifically, that trade is usually correct.
The Issuance Authority model
Two signatures over one statement, which is what a sealed paper transcript was:
{
"type": "manav-stmt/1",
"action": "credential_issuance",
"render": [
"Institution: [name, accreditation reference]",
"Graduate: [name, student identifier]",
"Credential: [degree] in [field]",
"Conferred: [date]",
"Honours / classification: [value]"
],
"registrar": "[credential assertion, office held]",
"institution": "[countersignature, published key]"
}The registrar's signature answers the issuance question. The institutional countersignature answers the institutional question. Both verify offline, against keys published at a stable location, with historical retention so a 2026 credential verifies in 2056.
Why the registrar's signature matters specifically
Institutional key compromise is the scenario that breaks institution-only schemes, and it is not hypothetical — signing infrastructure is compromised regularly across industries.
With a registrar signature, an institutional key compromise produces credentials lacking a valid registrar assertion, which is detectable. The two-signature structure is not ceremony; it is the property that contains a single-key failure.
What this does not do
It does not provide selective disclosure. A graduate presenting this receipt discloses everything in it, which for a degree credential is usually acceptable and for a transcript is not — transcripts should use a different construct, or a per-course issuance model.
It also does not verify accreditation, which is a separate question with a separate authority, and it does not detect a credential properly issued on the basis of fraudulent prior credentials.
What an issuance record should establish
| Element | Why it matters |
|---|---|
| The issuing institution's identity | That it is the institution it claims to be |
| The registrar's authority | That this individual could issue this credential |
| The scope of that authority | Which awards, which period |
| Whether it was delegated | And if so, by whom and within what bounds |
Objections and honest limits
“Accreditation covers institutional legitimacy.” It does, at the institution level and periodically. It says nothing about whether a specific issuance was authorised.
“We control who can use the registrar system.” With account permissions, which is the same shape as every other control discussed here: whoever can set the state can issue the credential.
Binding issuance authority
- Make issuance an explicitly signed act. By a named registrar, not a system state.
- Record the authority relied on. Delegated or direct, and its scope.
- Publish the institutional key. So a verifier tests the institution rather than trusting a template.
- Retain beyond the system's life. Credentials outlive registrar systems by decades.
Terms used here
- Issuance authority
- The institutional power to create a credential, typically delegated to a registrar and rarely recorded in a testable form.
- Delegated authority
- Authority exercised on another's behalf, within stated bounds. Common in registrar functions and usually invisible to a verifier.
- Trust anchor
- The published key a verifier uses to test that a credential came from the institution it claims.
Frequently asked questions
Does this compete with verifiable credentials? It is narrower and easier to deploy for one use case. Institutions investing in a full verifiable credential ecosystem should continue; the receipt suits those who need verification working next term rather than next decade.
What if the registrar leaves? Their signature remains valid for credentials issued during their tenure, verified against the key valid at that time. Office-holder transitions are handled by key validity periods.
How does a graduate use it? They hold a file and give it to an employer, who verifies it. No wallet, no account, no portal.
What about transcripts rather than degrees? A transcript discloses far more and needs selective disclosure, which this construct does not provide. Use it for degree conferral; use something richer for transcripts.
Why has forgery moved upstream? Because compromising or impersonating the issuance function produces genuine output, which no document check can detect.
What can a verifier test today? The document's appearance and, with effort, whether the institution is accredited. Not whether the issuance was authorised.
What should an institution publish? A key at a stable location, retained beyond the life of its registrar system, so old credentials remain verifiable.
Where this fits in Manav
Manav binds the person to the exact record, credential or submission being authorised, and produces a receipt a receiving institution or an integrity panel can verify without contacting the issuer.
Sources and further reading
- Registrar practice standards on credential issuance and verification.
- W3C Verifiable Credentials Data Model 2.0
- NACES / U.S. Department of Education accreditation resources
- CISA — known exploited vulnerabilities and incident reporting