How to verify DID Document returned from Resolver? about did-resolver HOT 6 CLOSED

Have solved this by returning the proof as part of the didResolutionMetadata. I'll close this issue now and I'm OK with the proposed answer that this should be up to individual implementations.

from did-resolver.

IMO it's up to to the method specific resolvers that you plug into this package to verify the integrity of the resolverd DID document. There is never going to be a "one size fits all" for verifying integrity of DID documents.

from did-resolver.

This link is relevant, but doesn't fully answer my question: https://w3c.github.io/did-core/#proving-control-of-a-did-and-did-document

"Signatures on DID documents are optional.", but doesn't describe further what field should be used.

from did-resolver.

You're on the right track, I think.
Since not all DID methods require proofs or signatures to be trusted, I don't think it should be a decision of this library to attempt to do the verification.

One could argue that signed DID documents do not prove much in the general sense and that trust in a DID document heavily depends on the DID method, not the signature.

I suppose that this lib could forward some DID resolution input metadata to the corresponding resolver, in which case you would be able to implement the verification directly in your resolver if it requires it.

from did-resolver.

This seems connected to #61.
I'm still not convinced that this library should be responsible for this verification, since it would be mixing too many layers of verification.

If this is no longer needed, please close. Otherwise, please provide more context

from did-resolver.

@sondreb FYI: Most DID methods implement the check that the DID document is valid within the DID resolver itself. This means that you should strive to always run the resolution process client side.

from did-resolver.