Trust Spanning Protocol (TSP) support tracking issue

Robrix aims to add experimental support for the Trust Spanning Protocol (TSP) atop its existing Matrix support.

Use Cases

1. Can provide an additional layer of identity verification using over-the-top TSP ID signatures, which acts as a supplement to Matrix's own built-in user verification concept.
   • Can offer proving of identities, which allows you to authenticate whether or not someone is who they say they are with a strong guarantee that their history/reputation has been checked.
   • A third party can also inspect and verify the identity of all other parties involved in the transaction.
   • Example: when selling tickets, you need a middleman to broker the sale but you want them to be able to jointly verify both parties securely.
2. Offer a full additional layer of encryption (using TSP text mode) such that even in an encrypted Matrix room, nobody can read your messages even if they hack into your Matrix account and are able to verify it to enable Matrix-level encryption.
   • Additional feature: private messages within a public room. This is a bad idea, as sending un-decryptable messages in a public room would irritate users. This should only be available in private, direct rooms.
   • Implementation idea: use either MessageType::Text with a custom MessageFormat, or a custom MessageType entirely for TSP-encrypted messages.
3. Show a warning ("smoke signal") for new contacts claiming to be someone you al ready know.
   • Can check the VID/DID identifier (from your wallet) to offer an additional degree of certainty.
   • Prevent "Pig Butchering" scam: "show me your verified ID to prove you are who you say you are" (which relies on the ID history, i.e., reputation of the wallet ID).
   • The TSP spec's term for this is "relationship" tracking.
4. Obtain "credentials" or "endorsements" from other users, which enables a user Alice (that you have already verified) to say something like "Alice confirms/endorses that a new user Bob is indeed they are who they say they are".
   • Endorsements don't rely on server-side data; they are collected within your wallet.
   • This offers portability (migrating IDs) without losing the history of verification (reputation) that your previous account had. This is because the notion of a verified ID & reputation are decoupled from the specific identity you use to login to a given service like Matrix.
     • This is not limited to Matrix; endorsements and verified users can also be used across other services, e.g., Mastodon, Bluesky, etc.
     • Addresses a common problem: if you want to create a new matrix account, you lose all of your verified status, your connections, your user-to-user verification. A TSP DID would allow you to take all of this with you to your new matrix account, or even to a new account like Bluesky or whatnot.

Tasks / Sub-issues

• Create a settings pane for wallet management (#557)
• Persist wallet data to persistent storage (#557)
• Create new wallets (#557)
• Display/inspect wallet contents
• Support verifying other users' DIDs and storing that as VIDs in the wallet, and any other necessary features offered by the TSP CLI. (#578)
• Associate a VID with one (or later, multiple) Matrix UserId. (#578)
  • This requires adding a Button to the UserProfileSlidingPane to bring up a TSP modal, in which you can input the user's TSP DID to verify it and associate it with their UserId. (#578)
  • Associate the currently-logged-in Matrix User ID with the default/active DID (#591).
• Show a special TSP badge on user avatars/profiles that have been verified in your wallet.
• Show an indicator badge next to messages that include a TSP signature, to inform the user whether the sender's signature is valid and can be verified by the sender's TSP identity in the user's local wallet. (#578)
• Create a receiver that listens for incoming TSP verification requests and handles them. (#578)
  • The implementation can be similar to the existing Matrix-level verification request and verification modal.
• Handle custom TSP message fields to display TSP signature info in the room timeline.

Resources:

• Main TSP repo
  • See examples/src/cli.rs (link
• Main TSP Rust SDK docs
• Commit adding MCP over TSP support