Error reference: Issuer
Is the key bound to the issuer – through a DID or because the verifying party trusts it?
A valid signature only shows that content and key match. This check asks further: who owns the key, and does the verifying party trust this issuer? KYA clearly distinguishes between keys the verifying party has provided itself and keys merely embedded in the evidence.
An embedded key is self-asserted. It is enough to verify the signature but not to prove the origin. Only a key from a trusted source makes the issuer a proven fact.
The codes in this check therefore usually lead not to an invalid but to an indeterminate verdict: nothing is disproven, but the origin is not proven.
issuer_key_not_trusted
The key comes from the evidence itself and is not bound to the issuer.
Cause: The issuer's key is known but does not come from the verifying party; it is merely embedded in the evidence and therefore self-asserted.
Fix: Obtain the key from a trusted source, such as the issuer's published JWKS, and provide it under “Trust of the verifying party”.
kid_issuer_mismatch
The key identifier points to a different identity than the issuer.
Cause: The key ID does not belong to the stated issuer, for example because the DID in the key ID differs from the issuer's DID.
Fix: The issuer must sign with a key that belongs to its own identifier. Check the configuration of the issuing system.
no_signed_artifact
No signed artifact present.
Cause: There is no signed element to which an issuer could be attributed.
Fix: Present signed evidence, such as a mandate as an SD-JWT VC or a decision as a JWS.
Common situations
Testing with your own data: anyone verifying self-created evidence for the first time often sees “key not trusted”. The key is then only embedded in the evidence. Provide the public key under “Trust of the verifying party”, and the check becomes valid.
Key rotation: if an issuer has rotated its key, the old key provided no longer matches. Keep issuers' JWKS current and keep old keys as long as older evidence must be verified.
Several environments: test and production systems often sign with different keys. Check which environment a piece of evidence comes from.
How to test this check
On the verification page, open the “Complete pack” example and remove the issuer's key under “Trust of the verifying party”. The check then reports that the key is not trusted, and the verdict becomes indeterminate.