Research

The ToIP KERI Suite WG spec (v0.10.3, still draft even though the underlying KERI/ACDC/CESR specs were ratified in January 2026) is strict by design: a resolver MUST fetch both did.json and keri.cesr, MUST verify the full key event log, and MUST fail on any mismatch — serving did.json alone degrades did:webs to plain did:web security and is explicitly non-conformant. A faithful TypeScript verifier means a clean-room CESR parser plus KEL state machine (~4–5k lines against keripy's ~25k-line reference; signify-ts is a KERIA client without the validator and drags runtime-WASM libsodium, which Workers block). With adoption still tutorial-grade — GLEIF's own testnet endpoint is down and no production did:webs is discoverable — ThisDID serves the method upstream, where Godiddy resolves the canonical tutorial DID via GLEIF's reference driver in ~200ms. An edge driver waits on production publishers or a maintained TS KEL verifier.