Topic starter
26/08/2026 11:51 am
TL;DR: Passkeys are moving into digital identity wallets through wwWallet, a passkey-enabled wallet project developed by Yubico and European research partners, with pilots now extending into interoperability, credential decryption, and verifiable credential presentation. The shift matters because wallet security, privacy, and cross-border trust now depend on identity controls that span human, NHI, and cryptographic credential lifecycles.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “Piloting Europe’s future ID: Passkeys securing digital wallets”.
Key questions
Q: How should security teams govern passkeys when they also unlock digital identity wallets?
A: Treat wallet passkeys as high-value authenticators because they can do more than start a session.
Q: Why do digital identity wallets change IAM assumptions about trust and recovery?
A: Wallets turn identity into a portable container that may cross services, organisations, and jurisdictions.
Q: What are the main control risks when verifiable credentials are stored in wallets?
A: The main risk is concentrated blast radius.
Practitioner guidance
- Govern the wallet trust boundary Define the wallet as a protected identity container, with controls for authentication, decryption, presentation signing, and recovery under one policy set.
- Classify passkeys by assurance role Separate ordinary login use from passkeys that unlock credential stores or sign verifiable credential presentations, because those functions raise the assurance requirement.
- Map interoperability trust assumptions Document which relying parties, issuers, and jurisdictions are allowed to trust the wallet, and specify the assurance level each integration requires.
Bottom line: Passkeys in digital identity wallets create a combined authentication and credential-custody problem that standard sign-in controls do not fully cover.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Wallet passkeys collapse the old separation between authentication and credential control: The same factor that opens the wallet also protects the stored credential set and the presentation step. That means authentication policy, cryptographic key protection, and credential governance now sit in one trust chain rather than in separate layers. Practitioners should treat wallet passkeys as a control surface spanning IAM and digital credential custody.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: When should organisations rethink their passkey programme for digital wallet use?
A: They should rethink it when passkeys move from login convenience to a mechanism for accessing and presenting regulated identity material. At that point, the programme is no longer just about replacing passwords, but about governing a cryptographic identity container.
👉 Read our full editorial: Passkeys in digital identity wallets: what wwWallet changes