How does the PeerBadge protocol work?

At a high level, PeerBadge works by an already trusted community member signing a badge for someone that they trust; that badge can then be verified by others as signed by the initial party. Even so, the badge itself cannot be mapped to the identity of the badge holder, keeping them anonymous.

At a technical level, it starts with a unique Nostr identity that a holder generates on their own device. This key represents their badge. The privacy and anonymity come from how the signing works. The device uses a method called blinding to "scramble" the key before it leaves the device.

This allows someone to sign a request without having access to the key inside it. Once the badge is signed, the holder's device unscrambles the key while maintaining the signature. The result is a signed badge with nothing linking the identity of the signer to the identity of the holder as the pairing is never recorded.

From there, verifiers check badge signatures as opposed to badge holder identities and can trace the signatures all the way back to an original trusted signer badge. Deciding which signers to trust, however, is always up to the individual verifiers. There is no endorsement by the protocol itself.

Keep in mind that a signed badge simply conveys the holder of that badge was vouched for by the person carrying another specific badge. Of course, signatures are revocable – so a badge that was previously signed can be subsequently unsigned if trust is abused.