I once encountered a rather absurd situation when verifying eligibility in Web3: there are platforms that only need to know whether I am eligible or not, but the process requires me to submit almost an entire set of documents.

KYC in one place, proof of funds in another, plus a few more wallet data for safety. In the end, what they really need is just a very simple answer, but the way they handle it seems like they want to retain as much user data as possible.

That's when I started to see the direction of $SIGN as much more interesting 😀

From my perspective, if we only talk about privacy, it's not enough to understand what they are trying to do. The more noteworthy point is selective disclosure.

That is, instead of forcing the user to reveal all records to prove a condition, the system only needs to show the verifier the necessary parts to make a decision. This is where I see SIGN can stand between privacy and compliance in a quite reasonable way.

Because compliance does not always need to know everything. In many cases, what the system needs is simply:
Has this user passed KYC?
Is this user of legal age?
Is this user eligible to participate?
Has this user passed some compliance rule?

But due to the lack of a strong enough layer of evidence, many apps still choose the most rudimentary way: asking for all raw data and keeping it in the backend. The problem is that this creates additional data liability for themselves and shifts all the risks to the user.

SIGN is suggesting a different direction.

They do not approach this problem as a single verify app, but as an evidence layer. Claims are defined according to a clear schema. Attestation acknowledges that the claim has been verified.

And more importantly, that claim does not necessarily have to come with all the original data. For me, this is where selective disclosure starts to have real meaning: verifiers do not need to see the entire record, just the right evidence for the condition being questioned.

This is a very significant difference.

Because if a protocol only needs to know that a user is eligible to join the whitelist, then it doesn't need all the KYC paperwork.

If an app only needs to know that a user has sufficient proof of funds over a certain threshold, then it doesn't need to see the entire portfolio. If a service only needs to know that a user is of legal age, then it doesn't need to know all identification information.

From my perspective, this is exactly how privacy and compliance can coexist: not hiding everything, but only revealing what needs to be revealed.

The point that makes me see this case closely aligns with the project is that SIGN does not require all data to live on-chain in one specific way. They support public, private, and hybrid attestations.

This is important because if everything must be pulled up on-chain, then selective disclosure will be very difficult to be genuine.

And if everything is outside the chain, the verifier will have difficulty trusting enough evidence. SIGN stands in between those two extremes by allowing claims to be anchored, queryable, verifiable, but not necessarily requiring the entire original payload to be public.

For me, this is a very practical point.

Because most of the tension between privacy and compliance does not lie in the question of 'can it be verified.'

It lies in how much it costs to verify. If the cost of compliance is gathering too much user data, then that system will eventually create more risks. And if the cost of privacy is that no one can verify anything, then it won't really fit into a regulated workflow.

SIGN is trying to open up a middle ground:
data can still be verified,
claims can still be traceable,
audits can still take place,
but verifiers do not need to see more than what is truly necessary.

I think this is why they deserve to be seen beyond the narrative of credentials or attestations.

Because credentials are just the most visible layer. The more important part lies in their ability to turn a compliance condition into a sufficiently concise claim, allowing other apps to rely on that claim instead of reverting to the old model of asking for the entire set of documents.

Of course, I don't think just having the right design is enough.

Selective disclosure is only truly valuable when the issuer designs a schema that is concise, the app integrates in the spirit of data minimization, and the verifier agrees to read only the necessary evidence instead of asking for more just to be sure.

If a protocol still wants to request all raw data for the convenience of their backend, then SIGN itself cannot force them to 'restrain' more.

But if viewed correctly in the direction they are building, I see SIGN as a quite reasonable bridge between privacy and compliance.

Not because they are making privacy tighter.

And because they are creating a way for the system to prove exactly what needs to be proven, to the right parties that need to see it, without having to reveal more than that.

For me, if this direction truly gains adoption, then the most noteworthy part in SIGN won't be about prettier attestations or more portable credentials. It lies in their ability to help Web3 break free from a very old habit: wanting to comply means having to collect as much data as possible.

And if they can do that, selective disclosure will no longer be a nice concept in docs. It will become a practical way to handle privacy and compliance, no longer seen as two opposing extremes.
@SignOfficial #SignDigitalSovereignInfra $SIGN