This is what I call the “metasystem”. It is responsible for the fidelity of the credentials, not their provenance.