SSI and privacy friendly sub-agents

[joepio]

The Agent model is designed to be a publicly accessible and verifiable (decentralized) identity that can be re-used by various apps. However, re-using an identity costs privacy. Of course, users could create new identities to deal with this, but ideally, these users should be able to (if they want) prove that they are made by some specific user.

How to achieve this?

Sign the key with your private key

Basically, have an anonymous signature that proves the parent Agent has signed it. However, this does mean a signficant attack vector: simply try the public keys of agents that you suspect.

There must be a better way.

Save the sub-agents private key somewhere safe, and prove it by simply signing a commit that says "yeah, this is my parent".

Way more elegant, but this allows the sub-agent to lie about who the parent is.

Still not ideal.

Sign a resource by both Agents that confirms they are the same

This is cryptographically sound and actually proves they are the same.