Digitization is intended to create more independence – so why are new dependencies emerging?
Digitization promises more flexibility, faster processes, and less dependence on analog structures. However, a closer look is particularly worthwhile when it comes to digital identity and the EUDI Wallet.
This is because a solution can function excellently from a technical perspective and still create new long-term dependencies. The decisive question is therefore not only: Does the solution work today? But also: Will users and organizations remain capable of action tomorrow?
When convenience becomes lock-in
Dependencies do not only arise when a system is technically closed.
They can already emerge when:
-
interfaces exist but are difficult to use in practice,
-
keys or identities are tied to a specific device or ecosystem,
-
or a single provider controls central components of a process.
What appears particularly convenient today can become a lock-in in the long run. Digital identities, however, are not short-lived applications. They are intended to support individuals, companies, and public authorities over many years.
Therefore, portability, interoperability, and long-term usability must be considered from the very beginning.
“Not your keys, not your identity”
When it comes to digital identities, the question of who actually holds control over the necessary cryptographic keys also plays an important role.
The fundamental idea behind “not your keys, not your identity” is simple: Anyone who has no personal influence on the cryptographic keys relevant to their identity and their management may be dependent on the underlying infrastructure for a key part of their digital identity.
This is not about users necessarily having to access private keys themselves. The decisive factor is rather who controls the keys, how they are protected, and what options exist in the event of loss, device changes, or recovery.
Storing keys directly on a smartphone therefore also raises questions. While modern smartphones offer powerful, hardware-supported security mechanisms, the question remains:
-
What happens when changing devices?
-
How easily can an identity be securely transferred or recovered?
-
What happens in the event of loss or a defect?
-
And how does one prevent a user-friendly solution from turning into a strong attachment to a specific device or ecosystem?
These are not marginal issues. They are part of the architecture of digital identities.
Certified does not automatically mean the entire system is secure
Certifications also play an important role in digital identities. Standards and certifications can prove that certain components meet defined security requirements. But here, too, the following applies: A certificate alone does not replace an analysis of the overall system.
Relevant factors include, for example:
-
the key storage used,
-
the hardware deployed,
-
the specific implementation,
-
the operating system,
-
update and life cycles
-
and the interaction of all participating components.
Especially with smartphones, devices, manufacturers, and security components differ significantly. Therefore, the discussion should not end with the question of whether something is “certified.” The decisive factor is which requirements were actually tested and how the overall system is structured in everyday use.
Why different carriers can be useful
Digital identity therefore does not necessarily have to be exclusively tied to a smartphone. Depending on the use case, different secure carriers can make sense.
A separate smart card, for example, can function independently of the smartphone being used and thus offer different possibilities regarding device changes, key management, recovery, or additional protection.
In our view, the key is not to fundamentally favor one technology over another. The key is to choose the right architecture for the respective use case.
Digital sovereignty means freedom of choice
For us at IDealWALLET, digital sovereignty does not mean having to develop everything ourselves or decentralize every infrastructure.
Rather, it means designing systems so that:
- standards remain interoperable,
- different technologies can be integrated,
- switching and secure recovery remain possible,
- users retain control over their identity,
- and organizations are not unnecessarily tied to individual providers or devices.
Because digital identity must not only be convenient; it must remain sustainable in the long term.
Conclusion: Working today is not enough
The quality of digital identity solutions is not determined solely by whether they function technically today. The decisive factor is also what dependencies they create for tomorrow.
That is why, in addition to security, interoperability, key control, portability, and technological openness must be taken into account for EUDI Wallets, digital credentials, and identity infrastructures.
Progress does not happen where we tie ourselves as quickly as possible to a single solution, but where we retain the freedom to continue developing it. Digital sovereignty does not mean building everything yourself. It means remaining capable of action.
