We catalogued 86 national digital ID schemes across 51 countries. The patterns that emerge, mobile-first, bank-led, biometric, and wallet-bound, tell you where identity is going and what to build for.

As NIST post-quantum standards mature, certificate and PKI vendors began planning crypto-agile migrations for machine identity.

Work continued on OAuth 2.1, which folds widely adopted security practices into a single specification and removes legacy grants.

The OpenID Foundation advanced OpenID for Verifiable Credentials profiles, improving interoperability for issuing and presenting digital credentials.

Adoption of the Shared Signals Framework and CAEP grew, letting providers share security events and revoke sessions in near real time.

The W3C finalized the Verifiable Credentials Data Model 2.0 family as Recommendations, a milestone for decentralized identity and the EU Digital Identity Wallet.

The OAuth 2.0 Security BCP became RFC 9700, consolidating hardening guidance such as PKCE everywhere and sender-constrained tokens.

The FIDO Alliance published specifications to let users securely move passkeys between providers, addressing a key adoption blocker.

NIST advanced SP 800-63-4, emphasizing phishing-resistant authentication, syncable passkeys, and revised identity proofing guidance.