On provider governance: there’s an on chain policy contract with an allowlist of accepted credential issuers. The deployer (token issuer, frontend operator, whoever) controls the list, adding or removing a provider is one transaction. The ZK proof verifies the credential was signed by someone in the accepted set without revealing which issuer. So each deployer decides their own trust assumptions.
On renewal: it’s configurable per policy. A token launch might want a proof from the last 24 hours. A frontend doing jurisdiction checks might accept 30 days. The circuit checks expiry at proof generation time, so stale credentials just fail. Shorter windows = stronger sanctions guarantees but more friction.
Are you building something where jurisdiction or access gating is relevant? Happy to go into more detail on the architecture.