Tracing the arc from browser PKI incompatibility through Semantic Web standards to the age of LLM-powered AI Agents and Skills
"Browser vendors offer suboptimal UI/UX for client-certificate authentication, effectively sidelining the cryptographic link between individuals and the open web beneath layers of complexity few could navigate. Semantic Web standards — WebID, the FOAF vocabulary, and the cert ontology — rebuilt that bridge through decentralized, linked-data identity. Now, LLM-powered AI Agents loosely coupled with Skills like YouID have democratized that bridge. Anyone can generate their own verifiable, machine-readable identity for use across the emerging Agentic Web."
Your social media and online profiles are not under your full control. Third parties increasingly make decisions on your behalf — based on their perception of you, not yours. YouID makes you the master curator of your own profile data, verifiable identity, and content indexes.
"Privacy is the self-calibration of one's vulnerability."
— Kingsley Uyi Idehen, Founder & CEO, OpenLink Software
Three distinct vulnerabilities define the digital identity crisis — and each has a precise, standards-based remedy:
Without cryptographic anchoring, anyone can claim to be you — through email spoofing, social account cloning, or credential theft. Digital signatures solve this: a self-sovereign X.509 certificate bound to your WebID cryptographically proves that any signed message or action genuinely originates from you, the keyholder — courtesy of the S/MIME protocol. The problem with S/MIME mirrors the browser's PKI failure: email clients have never made it easy for everyday users. The net effect is phishing, smishing, and vishing attacks that grow ever more sophisticated in the age of AI.
Platform providers hold the encryption keys to your communications, making true privacy structurally impossible. The remedy is end-to-end encryption where you control the keys — not the platform. A WebID-anchored certificate lets correspondents send you messages that only you, holding your private key, can decrypt.
Photos, posts, documents, and contacts on platforms are governed by platform terms — the platform decides who sees what, and may change those rules at any time. The remedy is fine-grained access controls expressed as entity-relationship collections using the Semantic Web: you specify exactly which WebID-identified agents may access each resource you create.
Browser vendors provide suboptimal UI/UX for client-certificate management — the interface that would allow users to install X.509 certificates and authenticate to services via mutual TLS. The technical capability exists in the standard, but the human-facing tooling is buried and inaccessible. PKI became asymmetric: servers authenticate to clients, but clients cannot practically authenticate via certificate. This left passwords, OAuth, and API keys as the only viable options — all centralized, all revocable by a third party.
Tim Berners-Lee argued that "we must not muddle the email address with the person" — identity must be a dereferenceable URI, not an authentication credential. WebID-TLS, the FOAF vocabulary, and the W3C cert ontology answered that call. By placing a WebID URI in the X.509 certificate's Subject Alternative Name field, and declaring the public key in a machine-readable FOAF profile, decentralized verification became possible. No Certificate Authority required — trust flows from the Linked Data web itself.
The YouID Skill encapsulates openssl, RDF template filling, multi-format generation, and WebDAV uploads. An LLM-powered AI Agent routes through the Skill on natural language instruction. The result: anyone — regardless of PKI expertise — can generate a verifiable, self-sovereign NetID for the emerging Agentic Web.
Identities are not exclusive to humans. AI Agents are first-class identity holders too — each agent operating on your behalf can hold its own NetID or WebID. The YouID Skill can generate a machine-computable delegation bundle — an RDF document asserting oplcert:onBehalfOf and oplcert:hasIdentityDelegate triples that formally link the agent's NetID to its human operator's NetID. The result is a two-identity system any service can verify: the agent is who it claims to be, and it is an authorized delegate of a specific, verified human principal.
Output of the whoami command in a YouID-enabled AI Agent environment — two verified NetIDs linked by a machine-computable oplcert:onBehalfOf delegation relation
/Users/kidehen/Documents/LLMs/Claude/ (rdf/, md/, webpages/)
…/ai-agent-skills/agent-rdf-memory/
Inherited from principal via delegation
Seven steps to generating a verifiable, self-sovereign NetID or WebID via an LLM-powered AI Agent and the YouID Skill — YouID handles the PKI so you don't have to
Secure a network location you control — a WebDAV/LDP endpoint, a personal domain, or a compatible data pod — and reserve a slot for your profile document there. The YouID Skill supports any resolvable identifier as your NetID; when that identifier is an HTTP URI, it becomes a WebID — appending a fragment such as #this to your profile document URL produces a stable, dereferenceable WebID URI scoped to the network-accessible space you own, e.g., https://yourdomain.com/people/you#this. This URI appears in the X.509 certificate's Subject Alternative Name field and in every RDF profile document generated by the YouID Skill.
Gather: your common name, professional title, email address, organization, country code (2-letter ISO), social profile URLs (LinkedIn, X, GitHub, etc.), an optional photo URL, and an optional personal profile page URL. These become the semantic assertions in your FOAF-based profile document.
Open your preferred LLM-powered AI Agent (Claude Code, GPT-5 Codex, DeepSeek, Grok CLI, etc.) and say: "Generate a credentials collection for me." The YouID Skill takes it from there — eliciting your identity parameters, establishing a sense of who you are that distinguishes you from the AI Agent environment you are operating within, and orchestrating the full generation workflow. No PKI expertise required.
The YouID Skill runs scripts/generate_certificate.sh to produce a self-signed RSA-2048 X.509 certificate with your WebID URI in the Subject Alternative Name field. The script extracts modulus, exponent, fingerprints, and NI/DI URIs into cert_data.json — the seed for all subsequent RDF documents.
The Basic WebID Test gate verifies that the RSA modulus and exponent from the generated cert.p12 match the cert:modulus and cert:exponent values in profile.ttl, profile.jsonld, and index.html. This gate must pass with zero failures before any identity document is delivered.
The YouID Skill uses curl PUT commands to upload all generated artifacts (profile.ttl, profile.jsonld, profile_rdfa.html, certificate.*, public_key.*, index.html, vcard.vcf, style.css, cert.pem, cert.crt) to your chosen WebDAV/LDP endpoint. The profile is now live and dereferenceable.
Your NetID — realized here as a WebID URI — is now a verifiable, portable, self-sovereign identity credential. Share it in email signatures, social profiles, and Agentic Web service registrations. AI Agents acting on your behalf will present the X.509 certificate derived from this identity; services will verify it by dereferencing your WebID profile and matching the declared public key.
The YouID Skill can also generate a verifiable identity for the AI Agent itself — giving the agent its own NetID or WebID and X.509 certificate. It then produces a delegation bundle — an RDF document asserting oplcert:onBehalfOf and oplcert:hasIdentityDelegate triples that formally link the agent's NetID to your human operator NetID. The whoami command in agent environments exercises this: it returns two verified identities — yours and the agent's — plus the machine-computable delegation relation between them.
Ten questions about self-sovereign identity, WebID, and the Agentic Web
cert:RSAPublicKey, cert:modulus, and cert:exponent — RDF terms that let a FOAF profile document declare the exact RSA public key values extracted from the X.509 certificate. When a WebID-TLS server fetches the profile and runs the key-match SPARQL query, it bridges the X.509 certificate world and a Semantic Web into a single cryptographic verification step.Key terms in the self-sovereign identity and Agentic Web vocabulary
oplcert:hasIdentityDelegate expresses the same relation from the human's perspective.oplcert:onBehalfOf and oplcert:hasIdentityDelegate triples formally linking them. Enables any service to verify both the agent's identity and its authorized relationship to its human principal.Explore the entity relationships in the YouID identity story. Click nodes to open entity descriptions via URIBurner.
Execute live queries against the companion Turtle knowledge graph hosted on URIBurner (Virtuoso-backed).
PREFIX schema: <http://schema.org/>
SELECT DISTINCT ?entity ?name ?description
FROM <https://linkeddata.uriburner.com/DAV/demos/daas/youid-self-sovereign-identity-claude_sonnet_4_6-1.ttl>
WHERE {
?entity schema:name ?name ;
schema:description ?description .
FILTER(LANG(?name) = 'en')
}
ORDER BY ?name
PREFIX schema: <http://schema.org/>
PREFIX : <https://linkeddata.uriburner.com/DAV/demos/daas/youid-self-sovereign-identity-claude_sonnet_4_6-1.ttl#>
SELECT ?pos ?question ?answer
FROM <https://linkeddata.uriburner.com/DAV/demos/daas/youid-self-sovereign-identity-claude_sonnet_4_6-1.ttl>
WHERE {
?q a schema:Question ;
schema:position ?pos ;
schema:name ?question ;
schema:acceptedAnswer/schema:text ?answer .
}
ORDER BY ?pos
PREFIX schema: <http://schema.org/>
SELECT ?term ?definition
FROM <https://linkeddata.uriburner.com/DAV/demos/daas/youid-self-sovereign-identity-claude_sonnet_4_6-1.ttl>
WHERE {
?t a schema:DefinedTerm ;
schema:name ?term ;
schema:description ?definition .
}
ORDER BY ?term
PREFIX schema: <http://schema.org/>
SELECT ?step ?name ?text
FROM <https://linkeddata.uriburner.com/DAV/demos/daas/youid-self-sovereign-identity-claude_sonnet_4_6-1.ttl>
WHERE {
?s a schema:HowToStep ;
schema:position ?step ;
schema:name ?name ;
schema:text ?text .
}
ORDER BY ?step
PREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
SELECT
?type
(SAMPLE(?s) AS ?sampleEntity)
(SAMPLE(?label) AS ?sampleLabel)
(COUNT(?s) AS ?entityCount)
WHERE {
GRAPH <https://linkeddata.uriburner.com/DAV/demos/daas/youid-self-sovereign-identity-claude_sonnet_4_6-1.ttl> {
?s rdf:type ?type .
OPTIONAL { ?s rdfs:label ?label }
}
}
GROUP BY ?type
ORDER BY DESC(?entityCount)