Give every digital artifact verifiable trust
Binaries, plugins, documents, and any downloadable file can now carry trust signals that anyone can verify.
You can't trust what you download
Some of the biggest security breaches in recent history happened because someone used a digital artifact that wasn't what they thought it was.
Malicious VS Code extensions
Poisoned plugins infiltrated open-source repositories, compromising developer environments at scale.
Fake meeting clients
Attackers impersonating investors tricked users into installing malware disguised as video conferencing apps.
Prompt injections in skills.md
A malicious skill can hijack an AI agent’s behavior, exfiltrate sensitive data, or trigger unauthorized actions.
The common thread
In every case, the victim had no reliable way to verify the artifact's origin. Existing signing mechanisms are fragmented across operating systems, app stores, and file formats, leaving many artifacts with little or no portable trust information. There is no internet-native, decentralized way for publishers to claim ownership of an artifact and have that claim independently verified.
From file to verifiable trust
One identity for every artifact
For trust to accumulate around an artifact, everyone has to agree on its identity. did:artifact defines a standardized way to derive an identity from any digital artifact. Every conforming implementation produces the same identifier for the same content.
Trust for every kind of artifact
Anything you download can carry a decentralized identity for trust signals.
Software Releases
Verify that a binary, installer, or package actually comes from the publisher before you run it.
Downloadable Binaries
Any executable distributed outside an app store can carry verifiable publisher identity.
Agent Configuration Files
Verify who published a skills.md or agent configuration file before allowing an AI agent to use it.
AI Models
Confirm that a model file was published by the organization that trained it, not a modified copy.
VS Code Extensions & Plugins
Ensure browser extensions, IDE plugins, and add-ons come from their stated developers.
Game Clients
Verify that a game client or launcher was published by the game studio, not a trojanized copy.
Security Audit Reports
Did that PDF security report actually come from the auditor? Verify it against their on-chain claim.
Documents & PDFs
Verify the origin of contracts, whitepapers, and official documents before acting on them.
Built on open, interoperable standards
did:artifact leverages established standards to ensure broad compatibility and long-term durability.
W3C DID
Built on the W3C Decentralized Identifiers standard for interoperability across ecosystems.
Read specdid:artifact
A purpose-built DID method that standardizes how digital artifacts are identified.
Read specEthereum Attestation Service
On-chain attestations provide tamper-proof, publicly verifiable trust claims.
Read specGive your artifacts a verifiable identity
Register your software, models, and digital artifacts on OMATrust. Let users and agents verify that what they downloaded is what you published.