The credential pipeline
Keyring turns a fact that already exists inside a web account into a credential a smart contract can check, without moving the underlying data. The pipeline has three cryptographic stages, each consuming the previous stage’s artifact.
Session to evidence
A user signs in to a provider they already have a relationship with. The session runs through TLSNotary: a second party, the notary, co-computes the TLS connection and signs commitments to its transcript without ever seeing the plaintext. Selected fields of the response are disclosed; everything else is redacted. The result is portable evidence that a specific server said a specific thing. Details: TLSNotary.
Evidence to attestation
Keyring verifies the evidence (notary signature, server identity, transcript commitments) and evaluates the disclosed fields against the policy’s rules. The user’s side then runs a zero-knowledge circuit that constructs an authorization message binding three things together: a private identity, an encrypted copy of that identity for designated authorities, and the policy payload. The message is signed blind, so the issuer cannot connect what it signed to anything that later appears on chain. Details: zero-knowledge proofs and credentials.
Attestation to credential
The signed attestation becomes a createCredential transaction on the
KeyringCore contract, which verifies the issuer signature on chain and stores
an expiration for the wallet and policy. From then on, compliance is a view
call: checkCredential(policyId, address).