history the work this stands on
attest is a late arrival in a conversation that has run for more than thirty years. Nearly every idea in it was someone else's first: that people can vouch for each other's keys, that reputation has an economics, that trust can be computed as a flow from people you already trust, that anyone can file the web under their own words, that you should be able to sign in without handing a password to every site, and that identity can belong to the person rather than the platform. This page is a thank-you, in rough order, to the people who did that work. Each entry says what it gave us and links to the original.
Dates and names come from the sources linked beside them. If something is wrong or missing, the ways in say how to tell us; corrections will be logged on the changes page.
Commons
1990 Elinor Ostrom, Governing the Commons. Eight design principles for communities that manage shared resources without a central owner, among them graduated sanctions and "rapid access to low-cost local arenas to resolve conflicts". She received the Nobel prize in economics in 2009.
Gave us: the frame for how trust communities should govern themselves, which is still an open question on our roadmap.
Keys and the first web of trust
1991–1992 Phil Zimmermann, PGP, and the web of trust, introduced in the manual for PGP 2.0: "everyone will gradually accumulate and distribute with their key a collection of certifying signatures from other people".
Gave us: the whole idea. People vouching for people, with no central authority, is where every system on this page starts.
Reputation and its economics
1995 eBay, founded by Pierre Omidyar, whose buyers and sellers "rate and review each other after each transaction". Its Feedback Forum, where "people go out of their way to accumulate positive comments", is the example Friedman and Resnick open with.
Gave us: proof that strangers will cooperate on the strength of a public record.
1999–2001 Eric Friedman and Paul Resnick, "The Social Cost of Cheap Pseudonyms". When identities are free, no arrangement sustains much more cooperation than making newcomers pay their dues.
Gave us: the reason every new key here starts at zero, and the honest price of letting people start over.
Trust as a computation
1999 Raph Levien, the Advogato trust metric. Trust computed as a network flow from seed accounts through peer certifications, with a capacity bound that limits how far a cluster of fakes can reach, later generalised to assertions about anything with an identifier.
Gave us: the nearest ancestor of our planned scoring, almost a specification for it.
2003 Sepandar Kamvar, Mario Schlosser and Hector Garcia-Molina, EigenTrust. Global trust by power iteration, anchored in a set of pre-trusted peers.
Gave us: the pre-trusted root, and a cheap way to compute from it.
2004 Zoltán Gyöngyi, Hector Garcia-Molina and Jan Pedersen, TrustRank. Trust propagated across the web from fewer than two hundred hand-checked sites.
Gave us: scoring the sources of the web from a curated root.
2005 Alice Cheng and Eric Friedman, "Sybilproof reputation mechanisms". No symmetric reputation function can resist fake identities; asymmetric ones, computed from a source, can.
Gave us: why every score here names whose view it is.
2006 Haifeng Yu, Michael Kaminsky, Phillip Gibbons and Abraham Flaxman, SybilGuard. Fake identities are cheap but trust relationships are not, so the number of fakes accepted is bounded by the few real relationships they can obtain.
Gave us: the reason a thousand fake accounts need not matter.
2012 Qiang Cao, Michael Sirivianos, Xiaowei Yang and Tiago Pregueiro, SybilRank. Rank rather than classify, by trust propagated from seeds, deployed at Tuenti.
Gave us: rank, do not accuse.
Tagging and social bookmarking
2003 Joshua Schachter and Peter Gadjokov, del.icio.us, "the first explicit opportunity where website users were given the ability to add their own tags to their bookmarks". By 2008 it held more than five million users and 180 million bookmarked URLs.
Gave us: tags, and the idea that a public record of what people save is worth keeping.
2004 Thomas Vander Wal named the pattern: folksonomy, a portmanteau of folk and taxonomy, with del.icio.us and Flickr as its early examples.
Gave us: the word for classification by everyone rather than by an editor.
2009 Maciej Cegłowski, Pinboard, "a focus on personal management of bookmarks using tags", which in 2017 acquired Delicious.
Gave us: the argument for bookmarks as a durable personal archive rather than a feed.
Federated identity
2005 Brad Fitzpatrick, OpenID, first called YADIS, "Yet Another Decentralized Identity Interoperability System". The OpenID Foundation followed in 2007 and OpenID Connect in 2014.
Gave us: sign in once, with an identity you choose, anywhere.
2005 Kaliya Young, Doc Searls and Phil Windley founded the Internet Identity Workshop, where much of the rest of this list was argued out in person.
Gave us: a place where this community still meets.
2006 Blaine Cook began OAuth while building OpenID for Twitter; published as RFC 5849 in 2010 and OAuth 2.0 as RFC 6749 in 2012.
Gave us: delegation without handing over a password, which our per-site device keys echo.
Identity that belongs to the person
2014 Chris Coyne, Max Krohn and others, Keybase, where "identities are proven by posting a signed statement as the account a user wishes to prove ownership of". Acquired by Zoom in 2020.
Gave us: proof of control, almost exactly as we do it.
2017 Webmention, a W3C Recommendation edited by Aaron Parecki, and the IndieWeb community around it: one site notifying another that it linked to it, identity as your own URL.
Gave us: the web itself as the social graph.
2022, 2025 Decentralized identifiers became a W3C Recommendation on July 19, 2022, and the Verifiable Credentials Data Model 2.0 on May 15, 2025, the work of their W3C working groups.
Gave us: the
did: identifiers every account here has.The social web on open protocols
2020 fiatjaf, Nostr: signed events from keys, relayed by anyone. Its reactions to arbitrary URLs and its identifier grammar were running before we started.
Gave us: proof that signed statements about any web page can simply exist.
2021 Community Notes, begun as Birdwatch at Twitter: a note is shown only when raters who usually disagree agree that it helps. Its code is open.
Gave us: a trust computation that rewards agreement across division.
2022 Bluesky Social, the AT Protocol, first released as the Authenticated Data Experiment: personal data repositories, portable identity, a public firehose, and labels any client can subscribe to.
Gave us: the fabric attest now runs on.
recent badge.blue, a specification for signatures on AT Protocol records bound to the repository they sit in, implemented in the atproto-attestation crate by ngerakines; the Hypercerts community's shared vocabulary for attestation; and Tangled's vouches, which others already reuse as a trust graph.
Gave us: the signature on every record here, and the shapes we write into.
Trust graphs and communities
2025– Kaliya Young, Kevin Triplett and Drummond Reed, and the Decentralized Trust Graph working group of Trust over IP and the Decentralized Identity Foundation: relationships as mutually signed credentials, communities as first-class members of the trust graph, and delegation to agents.
Gave us: the case that a web of trust made only of individuals cannot scale, and that a person is a community too.
And the rest
Many more fed this: the Wikipedia editors who rate sources and require a linked discussion as evidence; the Ethereum Attestation Service's clean attestation model; Hypothesis and its annotation of any passage on the web; BrightID, Proof of Humanity and Human Passport, whose attempts at proof of personhood taught us where we would rather not go; and the Farcaster designers, whose per-app keys under one identity we borrowed. The full reading list, fifty sources with the address and date each was read, is in the repository.
And, before any of it, Kurt Vonnegut's Cat's Cradle (1963), for the idea that a thing can be made entirely of its relationships.