The Truth About Trust 3: The Scaffolding We Actually Want

Every age builds its own scaffolding.

Not just the kind wrapped around buildings.

The invisible kind too.

The records, rules, rituals, institutions and tools that let strangers cooperate without everything collapsing into panic or predation. Payments clear. Doors open. Credentials hold. Packages arrive. Messages get where they are supposed to go. A person remains identifiable enough to work with without becoming so exposed that they are easy prey.

Most of the time we don’t even see this scaffolding.

That is usually a good sign.

You don’t think about the payment rail every time your card works. You don’t examine the hinges every time the door opens. You don’t rebuild the postal system every time a package arrives.

You just use it.

That was one of the deeper points hiding inside the first essay. Trust is not some decorative virtue sitting politely on the shelf beside all the other virtues.

Trust is load-bearing.

Remove it and the rest of the structure eventually starts behaving like a trap.

Article 2 looked at what happens when identity, data and economic life depend on systems that can mark, track and sort human beings without giving them any meaningful way to refuse.

The answer was not difficult to see.

Trust in a system like that eventually stops describing free cooperation and starts looking a lot more like managed obedience.

The problem was never simply that technology entered the picture.

The problem was where the trust got placed, how much of it was demanded, who benefited from it and whether the person inside the system retained any real ability to say no and walk away.

Article 2 ended by naming the next job.

If the blade can cut both ways, then we should probably spend some time thinking about how to keep the blade pointed in the right direction.

That is this essay.

Not a catalog of shiny products.

Not a shopping guide for protocols.

Not another sermon about a “trustless future,” as if the human condition can finally be debugged away with enough cryptography.

I want to look at the scaffolding we actually want.

James Madison, trying to explain why constitutional structure was necessary, wrote that “if men were angels” government would not need the devices built to restrain power.

Men are not angels.

Neither are institutions.

Neither are markets.

Protocol designers aren’t angels either.

That doesn’t make any of them demons.

It means we should stop designing systems that only work properly when everybody behaves perfectly.

Good architecture assumes people will sometimes be selfish, incompetent, greedy, afraid, careless, corrupt, tired, manipulated, mistaken or simply human, and then asks how much damage any one of them should be able to do when that happens.

That is what I mean by scaffolding.

It does not replace ethics, or character.

It does not replace wisdom.

It gives us something harder around the weak joints where abuse otherwise becomes easy, silent and eventually catastrophic.

For much of the last decade we kept being offered two choices.

The old world said trust the bank, trust the platform, trust the registrar, trust the state, trust the administrator, trust the interface, trust the process.

Then crypto came along and offered the opposite fantasy.

Trust nobody.

Trust nothing.

Put it in code.

Let mathematics solve politics, culture and human weakness.

Both ideas were childish.

Trust never disappears.

It moves.

A ledger can reduce how much we need to trust a central bookkeeper, but then we trust a protocol, a validator set and the integrity of the cryptography.

A credential system can reduce how much we trust a particular clerk, but then we trust whoever defined the schema, whoever issued the credential and whoever controls the root keys.

A private payment system can reduce how much we trust intermediaries with our transaction history, but then we trust the design of the pool, the proofs, the software and the boundaries of the anonymity set.

There is always trust somewhere.

The actual question is whether we can put it in healthier places, in smaller amounts, with terms that are visible, limited and revocable.

Keep coming back to that last word.

Revocable.

Article 2 argued that a trustworthy architecture needs at least three things: revocable keys, optional participation and limited visibility.

I still think that is the cleanest minimum.

If your keys cannot rotate, your life starts hardening around static points of control.

If one identity rail becomes mandatory for ordinary existence, participation is no longer really optional.

If every actor in the chain can correlate every part of your life, privacy disappears and freedom tends to follow it out the door.

These aren’t extra features.

They are the conditions that keep trust chosen instead of imposed.

The first beam in that scaffolding is money.

Modern life trained us to look at numbers on a screen and call them value.

They aren’t.

Money is not value.

Money is a symbol that condenses trust.

It works because we believe the symbol can be exchanged tomorrow for food, energy, labor, time, shelter or something else another human values.

Problems start when the symbols float so far away from actual production and actual obligation that the scoreboard starts impersonating the game.

A system can look incredibly rich while becoming incredibly brittle.

The job for the next generation of monetary rails is not to worship code because code is new.

It is to reconnect settlement, accounting and ownership to systems people can inspect and, where possible, back toward things that exist beyond pure financial theater.

Article 4 will go much deeper into that.

For now the point is simpler.

We don’t need to abolish money.

We need to know what the claims mean, who can change them, how they settle and what we are actually trusting when we use them.

The second beam is proof of personhood without bodily surrender.

There is a real problem here that needs to be solved.

People sometimes need to prove they are eligible, qualified, adult, resident, unique, authorized or simply human.

There is nothing inherently wrong with proving a fact.

The mistake is requiring someone to surrender the rest of themselves to prove one narrow thing.

You need to know I am over eighteen?

Fine.

Why do you need my birth date?

My address?

My passport number?

A scan of my face?

A database entry that can be correlated with five other databases for the rest of my life?

You didn’t need to know who I was.

You needed an answer to a question.

That is why some of the identity work happening now is so interesting.

ZKPassport lets developers request and verify specific attributes from passports and other identity documents without forcing the person to expose all of the underlying information.

Reclaim comes at a similar problem from another direction. It allows someone to prove information from an existing website or account and show that the data came from the intended source without simply handing raw account access to whoever wants the proof.

Rarimo is building around the same basic instinct with on-device identity checks and ZK registries where proofs can be shared and verified without turning the underlying personal information into another database waiting to be breached.

Different approaches.

Same instinct.

Prove less.

Reveal less.

Surrender less.

Because bodies do not rotate.

Passwords can rotate.

Keys can rotate.

Devices can rotate.

A face, an iris or a hand does not rotate.

Once ordinary life becomes tied to parts of the body that cannot be changed, every scanner can become a checkpoint and every compromise becomes permanent.

That is why “proof of personhood without orbs” is more than a slogan.

It is a design demand, and a human right.

There has to remain a meaningful difference between proving a claim and surrendering the whole claimant.

Article 5 will go much deeper into identity. Here it is enough to say that the architecture of freedom needs identity to remain granular, user-held and revocable everywhere revocability is possible.

The third beam is privacy.

We have mangled that word badly.

Privacy still gets discussed as if it were a cosmetic preference for dissidents, adulterers, criminals or the self-consciously paranoid.

That is an incredibly shallow way to understand human beings.

Privacy is what keeps every human exchange from becoming a performance.

Without it every friendship becomes a little more self-conscious. Every experiment becomes a little more dangerous. Every transaction becomes a statement. Every deviation becomes visible to systems that may or may not have any legitimate reason to see it.

Edward Snowden once said that dismissing privacy because one has “nothing to hide” is like dismissing free speech because one has “nothing to say.”

That cuts through a lot of nonsense very quickly.

Privacy is not mainly about secrecy.

It is about the integrity of the person.

It is about having space in your life where you are not constantly being translated into data for someone else’s use.

This is where Web3 privacy stops being theoretical.

Aztec is building a privacy-first Layer 2 on Ethereum where developers can choose what remains public and what remains private, including private state and private execution.

RAILGUN approaches the problem from another direction, bringing privacy directly into interactions with DeFi and smart contracts on existing chains.

zkBob narrows the scope toward private transfers, including stablecoins.

Umbra solves a deceptively simple problem with stealth payments: even receiving value should not require publishing one permanent address that lets the world follow you forever.

Privacy Pools tackles another problem entirely. It tries to preserve the ability to transact privately while allowing users to prove membership in acceptable deposit sets without exposing the transaction history underneath.

They do not all make the same tradeoffs.

Good.

Privacy is not one thing.

Sometimes you need to protect balances and counterparties.

Sometimes you need to hide intent before execution.

Sometimes you need to receive money without publishing a permanent identifier.

Sometimes you need to prove something about the origin of funds without exposing their entire path.

Sometimes you need to vote without making bribery easy.

Sometimes you just need one part of your life not to be automatically correlated with all the others.

Different trust failures happen at different layers.

They need different defenses.

The fourth beam is private coordination.

Most people understand why a ballot should be secret.

Then somehow we moved governance onchain and started pretending that making every vote permanently public was automatically more honest.

It isn’t that simple.

Public voting sounds noble until you remember bribery.

Retaliation.

Coercion.

Social pressure.

The quiet calculation of whether voting what you actually believe is worth becoming a target for everybody who disagrees.

Or the much simpler problem that if I can prove exactly how I voted, someone can pay me to vote that way.

MACI exists because of that problem.

It uses private onchain voting and zero-knowledge proofs to make bribery and collusion much harder while keeping the result verifiable.

Shutter comes at a nearby problem through threshold encryption, trying to create fairer information conditions before information should become public, including uses such as shielded voting and protection against malicious MEV.

Not everything should be opaque.

Not everything should be public either.

Sometimes a process stays more honest because we reveal only what needs to be revealed, when it needs to be revealed.

The fifth beam sits underneath a lot of the other ones.

Network privacy.

You can build perfect onchain privacy and still leak the person at the seams.

If wallet activity can be tied to an IP address, RPC requests, timing patterns or the metadata surrounding the traffic, then the beautifully encrypted application layer starts looking like a glass house with a very expensive lock on the front door.

The lock can be excellent.

The walls are still glass.

Nym was built around that problem.

Its mixnet is designed to obscure metadata, not only the content being sent. That includes the patterns around communication that can otherwise be used to correlate activity even when the application itself looks private.

HOPR works on the same neglected layer, using a decentralized mixnet to obscure IP addresses and other transport metadata that can expose users interacting with crypto applications before they have even submitted a transaction.

This stuff is less glamorous than a new wallet or a private DeFi app.

It is also foundational.

Without network privacy, a lot of supposedly private systems remain private only for people nobody is trying very hard to watch.

The sixth beam is honest computation.

Public blockchains gave us something extraordinary: shared state that lots of independent parties can verify.

They also gave us a very obvious limitation.

If every input, every balance, every condition and every internal branch has to remain public, then whole categories of normal human coordination become awkward or impossible.

Salary information.

Medical information.

Business negotiations.

Procurement.

Institutional data.

Private market positions.

The things people negotiate precisely because not every piece of information should be visible to the other side before the agreement is made.

We still want to know the computation was honest.

We do not always need to know every input that went into it.

That is why so much work has moved toward private computation.

Miden pushes transaction execution and proving toward the client, letting a user execute locally and provide the network with a zero-knowledge proof instead of exposing the underlying account state and code needed to verify the transaction.

INTMAX is exploring a heavily client-driven, stateless architecture aimed at scalability and privacy, especially around payments.

Fhenix has evolved toward CoFHE, using fully homomorphic encryption as a coprocessor that can bring encrypted computation to EVM chains without requiring every application to move onto a separate privacy network.

Zama is pushing the same cryptographic frontier with fhEVM tooling for confidential smart contracts and computation on encrypted values.

Different approaches.

Different assumptions.

Different weaknesses.

Good again.

The question isn’t which acronym wins.

The question is the same one we have been asking all the way through this essay.

Can I prove that something happened correctly without being forced to expose everything underneath it?

This is where one of Hannah Arendt’s warnings about bureaucracy comes to mind. At its worst, bureaucracy turns human beings into “mere cogs.”

That is exactly the danger of a system that decides legibility is the price of participation.

A human being does not need to become fully machine-readable before they deserve to be trusted.

Reveal enough to verify the relevant act.

Do not turn the whole person into a file.

The seventh beam is AI.

And AI puts pressure on every other beam at once.

AI did not create the trust problem.

It accelerated it.

Language can be generated.

Images can be generated.

Voice can be generated.

Code can be generated.

Now software itself can increasingly act on its own.

So the old questions get louder.

Who said this?

Which model acted?

On whose authority?

What information did it have?

What was it allowed to do?

Who gave it that authority?

Can it spend?

Can it vote?

Can it sign?

Can the authority be revoked?

What evidence survives after the action?

Can another party inspect what happened without having to trust the agent’s own explanation of itself?

Article 9 will go deep into this.

For now, AI forces us to take the scaffolding seriously.

If software is going to act economically, identity, permissioning, reputation, logging, provenance, revocation and constraints all have to get much better.

Otherwise machine-speed agency gets dropped into institutions where accountability still operates at the speed of humans trying to figure out what the hell happened.

The answer is not panic.

It is bounded authority.

Verifiable action.

Auditable provenance.

And a real ability to revoke the authority when the trust breaks down.

By now the structure should be visible.

The scaffolding we actually want is not one protocol.

It is not one chain.

It is not one wallet.

It is not one identity card, one proof system, one privacy tool or one perfect market design.

It is layers.

None of these layers abolishes trust.

They civilize it.

They shrink the places where trust has to be blind.

They give us more places where trust can be checked.

And they preserve the conditions that allow trust to remain freely given.

A weak culture keeps asking for one master solution. A stronger culture understands that different trust failures occur at different layers and need different defenses.

That sentence may actually be the reason for all of this.

Because the point of building this scaffolding is not simply to have better privacy tools, better identity, better money, better governance, or better cryptography.

The point is what those things allow us to do together.

They allow us to distribute power without first requiring one institution to become the root of trust for an entire human life.

That changes the whole thing.

For most of history we have solved coordination problems by building larger centers of authority.

Sometimes that was necessary.

Sometimes it worked remarkably well.

But power has a habit of accumulating around the systems that people cannot afford to leave.

Your bank becomes more than a place that holds money.

Your identity provider becomes more than a way to prove who you are.

Your government record becomes more than a record.

Your phone and phone number becomes more than a phone.

The platform becomes the place where your work, relationships, reputation, money, identity and access all begin to converge.

Then leaving stops being a choice.

It becomes exile.

That is the thing this architecture should prevent.

Polycentric governance is a complicated name for a fairly human idea: there should be many centers of legitimate authority, each responsible for what it actually knows and can reasonably govern, none automatically entitled to rule all the others.

A town, a family, a professional body, a cooperative, a protocol can govern some things.

A local community, a farm, a church, a DAO, a scientific institution, a state, a network of peers can each hold different kinds of authority for different reasons.

Those centers can overlap. There is a kind of ikigai in this diagram.

They can cooperate, or disagree.

They can check one another.

They can even fail, and do that thing that trust always does, move.

What they should not be able to do is turn authority granted for one purpose into authority over everything else.

That is where trust architecture stops being abstract.

If I trust a doctor with my medical information, I have not trusted my employer with it.

If I prove I am over eighteen, I have not agreed to give someone my birth date, my address, my passport number and every other fact attached to my identity.

If I trust a community to govern the use of a shared resource, I have not given that community authority over my money.

If I trust someone to make treasury decisions, that does not mean I trust them to determine who I am.

Power should be specific because trust is specific. Trust is not a single number.

As Bob Seger once sang in “Feel Like a Number,” backed by the Silver Bullet Band: “I’m not a number… dammit, I’m a man.” There are no silver bullet solutions, but I do like the band.

We already know this intuitively between humans.

The mistake was building digital systems that forgot it.

This is why we need narrow proofs.

It is why I keep pointing to ZKPassport.

Why Reclaim.

Why an identity architecture built around proving the needed fact instead of surrendering the entire person.

It is not just privacy for privacy’s sake.

It prevents one center from automatically becoming all of the other centers.

The same is true of private coordination.

A public governance system does not become more legitimate simply because every decision can be watched by everyone in real time.

Sometimes the ability to watch changes the decision.

Sometimes it invites bribery.

Sometimes retaliation.

Sometimes it just creates the quiet pressure to vote the way your tribe expects you to vote.

That is why I keep pointing to things like MACI and the work Shutter DAO does.

Not because every vote should be secret.

Because the architecture should allow the amount of visibility required by the situation instead of making total exposure the default.

Again, specific trust.

Specific authority.

Specific visibility.

Not one setting for an entire society.

The same pattern repeats with money.

Settlement should prove that value moved.

That does not mean everyone needs to know everything about everyone involved. It certainly does not mean the person with the most of it deserves the most trust! More on that in part 4.

The same pattern repeats with computation.

The system should be able to prove that something happened correctly without always requiring every input to be exposed.

The same pattern repeats at the network layer.

A private transaction is not private if the infrastructure quietly records who made it, from where, at what time and through which endpoint.

Every beam we have already talked about is doing the same deeper job.

It is preventing one necessary trust relationship from expanding silently into ten others.

And then there is authority itself.

This is where I think we have barely started in our new technology driven framework. Humanity has spent years centralizing and modernizing for efficiency sake. Central governments, central banks.

We have now spent years trying to decentralize governance by distributing tokens.

That was never enough.

Money can buy a token.

Money can buy many tokens.

A token can prove someone has something at risk.

Delegation can prove that another tokenholder gave someone their voting power.

None of those things prove wisdom or competence.

None prove that someone did what they promised to do, or that their previous decisions made the system healthier.

We have treated proxies for trust as though they were trust itself.

They are not.

A better architecture should allow merit to accumulate.

Not some universal social credit score.

That would be exactly the master solution we are trying to get away from.

Merit has to have context.

Someone can have extraordinary judgment about cryptographic security and be completely useless at growing food.

Someone can be excellent at treasury management and terrible at leading people.

Someone can be deeply trusted by a local community without having any reason to hold authority in a global protocol.

That is fine.

That is healthy.

That is human.

The system should be able to remember what someone actually did, under what authority, using what information, what happened afterward and whether the result matched what was promised.

That is MRV again.

Just in another form.

Measurement.

Reporting.

Verification.

We normally talk about those things when funding public goods.

Did the trees get planted?

Did the software get built?

Did the money reach the people it was supposed to reach?

But governance needs the same thing.

You made a decision.

What happened?

You were given authority.

How did you use it?

You said this risk mattered.

Were you right?

You were funded to do the work.

Did you do it?

You failed.

What did you do next?

That history should count.

Someone or some AI agent even, who repeatedly demonstrates good judgment should be able to earn more authority in the domain where that judgment has been demonstrated.

Someone who repeatedly produces useful work should not have to return to zero every time a new funding round opens.

Someone who verifies other people’s work accurately should gradually become a more useful verifier.

Someone who abuses authority should lose it.

Authority becomes something that can move.

Not forever.

Not everywhere.

Not because a token balance says so.

Because the trust relationship earned it.

And revocability has to remain underneath the whole thing.

That is the part I think people skip when they imagine decentralized governance.

Decentralization does not mean nobody has power.

That makes no sense.

People need authority to do things.

Organizations need people who can act.

A farm cannot hold a token vote every time a pump breaks.

A company cannot ask its entire community to approve every payment.

A city doesn’t need a referendum for every traffic light.

The question is not whether someone gets power.

The question is how they got it, how much they got, what they can do with it, how we know whether they used it well, and how that power can be taken back when the trust no longer holds.

That is a governance system.

And if you build it properly, distribution of power does not have to mean paralysis.

It can mean lots of centers of action, each carrying the authority necessary to do the work, with enough evidence around those relationships that nobody has to pretend trust does not exist.

Then comes the right to leave.

This may be the most important test of all.

If leaving one system means losing your identity, your money, your credentials, your history, your social relationships and your ability to participate in economic life, you were never meaningfully free inside that system.

You were captive and compliant by default.

There was no real trust there to be willingly accepted in the face of risk.

There was just a cage that, even if you could squeeze through the bars and escape, you wouldn’t be able to take anything with you.

Optional participation only means something if true exit is survivable.

That is why portable identity matters.

Why keys must rotate.

Why privacy matters.

Why credentials should not belong to one issuer.

It’s why payment rails cannot become universal permissioning systems.

It’s why there cannot be one master reputation score deciding whether a human deserves access to the world.

This is humanity’s why for answering the question of why infrastructure itself needs many centers.

You should be able to leave one community and remain a person.

Leave one employer and keep your history.

Leave a platform and keep your relationships.

Leave one governance system and retain the evidence of the work you actually did.

Leave one political jurisdiction, when that is possible, without every other layer of life being automatically revoked with it.

That is the famed “walk-away test” in reality.

Not whether exiting is painless.

Trust always carries vulnerability.

There can be cost.

There can be loss.

There can be relationships that do not survive.

The question is whether one broken trust relationship has been allowed to become the kill switch for all the others.

This is also where AI may finally matter in a way that is much more interesting than another chatbot.

Everything I am describing sounds complicated because it is complicated.

Humans are complicated.

Organizations are complicated.

Trust is contextual.

Authority changes.

Evidence comes in different forms.

A farm produces different evidence than a software team.

A community makes decisions differently than a protocol.

A treasury manager should not be evaluated like a scientist.

Trying to squeeze all of that into one standardized form is how we got the bureaucracies everyone hates in the first place. It is how we created the broken system we are trying so hard to exit from and overcome.

So I say, don’t.

Don’t squeeze everything into a single container.

Humans are multifaceted, complex, individual beings.

Standardize the underlying structure where it can be standardized and let AI deal with the translation.

Let the farmer show what happened in the way that makes sense on a farm, the developer point at the code, and the community record its decisions.

Let the system help turn those very different forms of evidence into something inspectable without asking every human to become an expert in schemas, attestations, cryptography and data architecture.

That is where things like shared agents become interesting.

Not an AI that governs us.

It is important that AI systems be constructed with the same trust architecture and for the same reason: bounded authority.

An AI that helps us carry the institutional memory humans are terrible at carrying?

That is a useful advancement.

So long as it is not tied to a central single source of failure.

Separate the information store from the execution.

Then let the AI do what it is good at and parse the answers.

Why did we make this decision?

Who had authority?

What evidence did they have?

What did they promise?

What happened?

What has this person done before?

Where are the contradictions?

What still needs to be verified?

Strip away the coordination tax, the reporting tax.

Strip away as much of the complexity as we can without stripping away the evidence.

The evidence remains outside and always inspectable by third and fourth parties, AI and human alike.

Then humans can do the thing humans are actually supposed to do.

Judge.

Choose.

Trust.

Refuse.

Forgive.

Try again.

That is the why for the scaffolding we actually want.

Not a technically perfect world, ruled by code and all-powerful machines.

Not even one giant decentralized machine or a global DAO.

Not one identity, or currency, or governance system.

Not one model deciding what is true.

Not one institution we finally found worthy enough to trust with everything.

That is the old mistake with better branding.

The architecture we actually want makes room for many centers because human life already has many centers.

It lets them interact without forcing them to collapse into one another.

It lets authority exist without automatically becoming permanent.

It lets merit produce greater trust without turning reputation into caste.

It lets people prove enough without revealing everything.

It gives us ways to coordinate without making surveillance the price of cooperation.

And when one center fails, the others are still there.

That may be the deepest reason to build any of this.

Not because cryptography will save us.

Not because decentralization is inherently virtuous, or because institutions are inherently bad.

But because people are people. Power concentrates, institutions drift and leaders fail.

Communities make mistakes.

Good intentions age, which is why we don’t judge history by the morals of today.

There are no silver bullets that solve all the problems.

Even if there were, you would still need a gun to shoot it and a hand connected to a person to fire it.

You would still need the coordination to aim and the judgment to shoot at the right target.

In short, even a silver bullet solution would require a lot of coordination to achieve its goal.

So let’s build the scaffolding we actually want and leave all the shooting behind us.

And that brings us back to the start.

The goal was never to build a world where nobody relies on anyone.

That isn’t freedom.

That is isolation fortified by paranoia.

The goal is a world where people can rely on one another without having to surrender themselves wholesale to systems that remember too much, reveal too much and forgive too little.

A world where trust remains human, but the machinery around it becomes harder to abuse.

That is the work we still have in front of us, and the tools to build the scaffolding we actually want are getting better all the time.

It isn’t particularly glamorous.

It doesn’t fit neatly into a slogan or a marketing deck.

And it will never be clean enough for the ideologues who need one camp to defeat the other before they can imagine progress.

Fine.

Build the better joints in the tower anyway.

Do it before the next strong wind arrives.

The first essay argued that trust is the only real value layer.

The second showed what happens when identity systems remove the right to refuse and how trust can be broken and bent into a cage.

This third essay is the map that follows from both.

If trust is load-bearing, then the civilization worth building is one that protects the conditions under which trust can be freely given instead of treating trust itself as raw material to be extracted.

Technology will not make people kind.

It will not make institutions wise nor will it remove the moral burden of deciding whom and what to trust.

I don’t want it to.

At its best it can do something much humbler.

It can make fewer betrayals permanent.

It can give us rooms without microphones.

Credentials without dossiers.

Money without compulsory confession.

Computation without total exposure.

Governance without easy coercion.

It can leave us enough room to remain complicated, imperfect, private human beings while still giving us better ways to cooperate.

And maybe, if we build this well, the word “trustless” can finally shrink back to its proper size.

The deeper trust will still be what it always was.

The willingness to accept vulnerability in the presence of risk.

The courage to rely on one another.

And the right to walk away when we must.