Trust Tiers
Mark uses a tiered identity assurance model. Higher tiers mean stronger proof of who signed — not better cryptography. Every tier uses the same Ed25519 signatures.
Overview
Trust tiers answer a single question: how confident can a verifier be that the signer is who they claim to be? The cryptographic proof is identical at every tier. What changes is the identity evidence behind the key.
The five tiers
5 tiersTier details
T0 — Anonymous
The signer has a valid key pair and can produce cryptographically sound signatures, but makes no identity claim. Useful for whistleblowers, pseudonymous authors, or situations where identity is irrelevant.
T1 — Self-declared
The signer provides a name and email address. These are included in the service record but are not independently verified. This is roughly equivalent to a self-signed certificate.
T2 — Domain-verified
The signer proves control of a DNS domain by publishing a TXT record containing their identity fingerprint. The verifier can independently confirm domain ownership at verification time.
T3 — Organization-verified
An organization administrator (who is themselves at least T2) vouches for the signer as a member. The organization's identity is recorded in the service record, creating a chain of accountability.
T4 — Hardware-attested
The signer's root key is stored on a certified hardware security module — currently a YubiKey 5 series with firmware 5.7+. The device provides a cryptographic attestation certificate proving the key was generated on-device and cannot be exported. See the YubiKey Guide for setup instructions.
Upgrading tiers
Tiers are additive — you can upgrade at any time without losing your identity or invalidating past signatures. Your root key stays the same; only the identity evidence changes.
Downgrading is also possible (e.g., removing domain verification) but past signatures retain the tier that was active at signing time.
The verifier's perspective
When a verifier checks a signature, the trust tier is displayed prominently. The verifier decides how much weight to give it — Mark presents the evidence, not the verdict.
A T0 signature from an unknown key is cryptographically just as valid as a T4 signature from a hardware-attested corporate officer. The difference is in what the verifier can conclude about the signer's real-world identity.