Trust anchors sit in two kinds of list. Member States publish national Trusted Lists of qualified trust service providers, which inside the wallet ecosystem cover QEAA providers only. Everyone else who needs a trust anchor goes on a List of Trusted Entities signed and published by the Commission. A verifier checks an issuer against whichever list applies before relying on its signature.
A signature only means something if you know who holds the key. Trust lists answer that at EU scale, by two different routes. For Trusted Lists each Member State signs and publishes its own and registers the location with the Commission List of Trusted Lists. For Lists of Trusted Entities the Member State notifies the entity and the Commission signs and publishes the list itself, announcing the locations in the Official Journal. Either way a verifier in one country can validate an issuer in another with no bilateral arrangement.
It works in the other direction too, but not through a list. There is no Trusted List or LoTE for relying parties, because the number of them in the Union makes that impractical. A relying party instead carries an access certificate that identifies it and a registration certificate that states its attribute scope, and the wallet validates those against the lists of the authorities that issued them.
This is more work than it looks. A relying party has to support both formats, ETSI TS 119 612 for Trusted Lists and ETSI TS 119 602 for LoTEs, and refresh every applicable list regularly. One trap worth knowing: entries are never deleted. A provider that loses trust has its status set to invalid and stays on the list, so treating absence as revocation is a bug.
Defined in
ARF v3.0.0 section 3.5 and Annex 2 OIA_15; Regulation (EU) No 910/2014 Art. 22
Verifying a signature without checking the trust list means accepting credentials from anyone who can sign. The list is what makes cross-border verification safe without prior relationships.
Authbound handles the protocols, formats, trust lists and revocation checks behind these terms. See what people build with them.
