How an Issuer Gets Trusted, and the Sixty Seconds Nobody Mentions
Your wallet does not decide which issuers to trust and neither does the chain. A registry does, on a different surface, and this page describes it because a holder will eventually ask why one credential counts and another does not.
What the registry records about an issuer
An identifier, and whether the issuer signs with its own key or through a delegated arrangement.
A status: enrolled, suspended, or de-listed. Three states rather than a boolean, because suspension and removal are different events with different consequences.
A scope of levels the issuer is accredited for, constrained to the defined vocabulary and required to contain at least one. An issuer accredited for a lower level cannot issue at a higher one, which is the same downhill rule the levels themselves follow.
Who accredited it, recorded on every row.
And a separate table of status events, so a change of standing leaves a trail rather than overwriting the previous answer.
There is one accreditor, and it is us
The accreditor column exists so rows stay interpretable later. Today every row names the same party.
The schema's own comment concedes the limit rather than hiding it: real federation is one to many, with multiple accreditors each carrying their own scope and validity window, and it will need a join table this schema does not have. The single column guarantees that current rows migrate cleanly, not that the migration is avoided.
That is the right way to write down a known future cost, and it is worth reading twice: the design does not pretend the scalar is enough.
The sixty seconds
Enrolled entries are cacheable for a minute.
So an issuer de-listed at some moment can still read as enrolled for up to sixty seconds afterwards, at any verifier that took the cached answer.
And the revocation list does not close that window. A status list carries per-credential status, not issuer standing, so the mechanism most people would expect to cover this covers something else.
The route's own comment names the trade and accepts it for the first version. Publishing it here costs nothing and hiding it would eventually cost somebody a minute of misplaced trust, which is short unless it is the minute that mattered.
What the registry deliberately does not tell you
Why an issuer was de-listed. The status and the timestamp are public; the reason is not.
That is a defensible choice, since a public reason invites disputes the registry is not equipped to adjudicate, and a de-listing is already a strong enough signal. It is also a limit: a verifier learns that standing was withdrawn and not whether the withdrawal was administrative or serious.
The clean part, stated with equal prominence
A de-listed issuer returns a definitive answer rather than a not-found.
The registry separates removed from never heard of. A registry that answers both with silence turns a withdrawal into an ambiguity, and a verifier cannot tell a de-listed issuer from a typo.
What this means for you as a holder
Nothing you can act on directly. Your wallet shows the issuer identifier and makes no judgement about it, and the registry is consulted by verifiers rather than by you.
The reason to know it exists is that the answer to "will this credential be accepted" lives there, changes without telling you, and can change while a cached copy still says otherwise.