Britain does not need an ID card. It needs a way to prove you are you.

Nearly three million people signed a petition against it. The Home Affairs Committee has published a report on it. The Public Accounts Committee opened an inquiry into what it costs and whether it can be delivered. A consultation ran to May and the mandatory element has already been walked back once.

And through all of it, the argument has been about the wrong noun.

Almost every exchange I have read reduces to whether Britain should have an identity card. Supporters say a card is convenient and would settle several policy problems at once. Opponents say a card is the state's foot in the door. Both sides are debating the object. The object was never the risky part.

The risky part is the architecture behind it, and that has barely been discussed in public at all.

Two systems that look identical to a citizen

Picture two schemes. In both, you hold something on your phone. In both, you prove things about yourself in seconds instead of digging out a utility bill. To the person using it, they are the same product.

In the first, a government service holds a record of you, and every time you prove something, the checking party asks that service and the service answers. In the second, you hold cryptographically signed statements about yourself, issued once by whoever is authoritative for that fact, and you present the specific statement required without anything phoning home.

Same experience. Utterly different systems. The first creates a live, queryable, continuously updated index of where every citizen was, what they were doing and who was asking. The second does not, because there is nothing in the middle to record it.

That difference is the whole debate, and it is being conducted almost entirely through arguments about civil liberties rather than arguments about system design, which is a shame, because the design argument is the one that can actually be settled.

Function creep is not a policy risk

The standard reassurance is that the scheme will be limited to specific purposes, with safeguards, and that any expansion would require proper scrutiny. I believe the people making that promise mean it. I also think it is worth close to nothing, because it is the wrong kind of promise.

A policy commitment binds the government that makes it. It does not bind the next one, or the one after a crisis. What binds a future government is what the system is physically capable of doing. If you build infrastructure that can answer the question "where has this person been asked to identify themselves in the last two years", then that question is answerable, and it will eventually be asked, because the cost of asking is nil and the reason will be excellent at the time.

The corollary is the constructive bit. If the system genuinely cannot answer it, no promise is needed. Architecture is the only safeguard that survives a change of government, and unlike a policy, it can be independently verified by people who do not trust you.

This is also why "the data will be held securely" misses. Of course it will be held securely. The problem with a national identity register is not that it will be badly protected, it is that it will be well protected and still worth attacking, because a single store containing verified identity data for an entire population is the most valuable target that could be constructed in this country. Its value scales with completeness. Every improvement to its usefulness makes it a better prize.

Most checks do not need your identity

One point changes the shape of the whole problem.

Run through the checks a normal adult faces. Buying alcohol. Renting a flat. Starting a job. Opening an account. Collecting a parcel. Getting a discount that depends on your age. In almost none of them does the checking party need to know who you are. They need to know one fact about you, and they need to know it is true.

The shop needs to know you are over eighteen. It does not need your name, your date of birth or your address, and it certainly does not need a record of the transaction sitting in a government system. The employer needs to know you have the right to work. That is a yes or no. The landlord needs to know the same thing. We have simply been handing over full identity documents for all of it because paper cannot do anything more precise, and then we digitised the paper instead of digitising the question.

The cryptography for doing this properly is not experimental. Selective disclosure, where a signed credential lets you reveal one field and withhold the rest, is in shipping standards. Predicate proofs, where you prove a statement about a value without revealing the value, are older than most of the companies now arguing about identity policy. The EU has already committed to it: every member state must make a digital identity wallet available by the end of 2026, built around selective disclosure by default, with obligated organisations required to accept it a year later.

So the technical objection is gone. What remains is an institutional preference for the centralised design, because it is easier to procure, easier to govern from the middle, and it produces a system whose owner can see everything happening inside it. Those are real advantages. They are advantages for the operator, not for the citizen, and they should be argued for openly rather than smuggled in as an implementation detail.

What I would actually want

I build identity infrastructure for a living, so let me be specific rather than merely sceptical. Five properties, and I would judge any scheme on them.

The credential lives with the person. Issued by whoever is authoritative for that fact, held by the citizen, presented directly. No central service sitting in the path of every check.

Answer the question, not the identity. The default response to "is this person over eighteen" is yes or no. Anything beyond that should require a specific legal reason, declared in advance, visible to the person at the moment they are asked.

The audit trail belongs to the citizen. You should be able to see every organisation that has checked you, when, and what they asked for. That log should be yours, not a facility for the operator. Give people the receipts and abuse becomes visible without a single new regulation.

Revocable and re-issuable. Lose your phone and the credential dies cleanly and is replaced without you having to prove your existence from scratch. Any identity system that becomes a catastrophe when a device is lost has moved the risk onto the person least able to carry it.

Optional in fact, not just in name. A scheme is voluntary when the alternative route is genuinely usable, not when it exists on paper and takes six weeks. The mandatory question has already moved once under pressure. Watch what happens to the alternative routes, because that is where a voluntary scheme quietly becomes compulsory.

The part almost nobody is arguing about

There is a gap in all of this that sits closer to my own work, and it applies whichever architecture wins.

A credential proves that a valid document exists and that its holder passed a check at some point in the past. It does not prove that the authorised human is the one presenting it right now. That distinction is where the actual fraud lives. Stolen credentials are presented by people who are not their owners every day, and a beautifully designed selective-disclosure wallet on a stolen, unlocked phone is a beautifully designed way to be someone else.

Which is why I would spend less of the national argument on what the card looks like and more on the moment of use: confirming that the live human present at the check is the human the credential was issued to, with a decision made at that instant, weighing several independent signals, so that one stolen factor is never sufficient.

Get that right and the storage question becomes much less frightening, because a record that cannot be used by anyone other than its owner is a far smaller prize. Get it wrong and it does not matter whether the database is central or distributed. You have built an expensive way to be impersonated with confidence.