Digital certificates vs NFTs: what a product needs, and where a blockchain fits

Every brand that looks at digital certificates for its products meets the same question sooner or later: should the certificate be a non-fungible token (NFT)? Several of the digital product passports offered to luxury houses are built on blockchains, by industry consortia and by token-based passport providers, and the pitch is persuasive. A token cannot be forged, the ledger cannot be quietly edited, and the record outlives any one company.

Vera ties each certificate to its object with a tag and keeps the record for the brand. That is a design decision, and this piece sets out the reasoning. It is not an argument that blockchains are insecure. It is an argument about what each approach actually proves about a physical object.

An NFT is an entry in a ledger. Under ERC-721 (Ethereum Request for Comment 721), the Ethereum standard for non-fungible tokens, a contract tracks which address owns each token. The description of what the token stands for is an optional extension: a Uniform Resource Identifier (URI) that may point to a JavaScript Object Notation (JSON) file kept somewhere else. The standard says NFTs can represent ownership over digital or physical assets, and represent is the word doing the work.¹

What the ledger shows with certainty is narrower. It shows that a particular wallet controls a particular token entry, and the history of transfers between wallets. The overview of blockchain technology from the US National Institute of Standards and Technology (NIST) is explicit that a transaction signature links transactions to the holders of private keys but provides no way of associating real-world identities with them. A wallet is not a person, and a token is not a watch.²

The harder problem sits outside the ledger. NIST calls it the oracle problem: a blockchain can record data about the real world, but there may be no way to determine whether that data reflects real-world events. Its own example is a purchase of a physical item, where nothing within the blockchain can show whether the shipment ever took place.²

For products, the consequence is plain. A token can be minted correctly, held in the right wallet and transferred flawlessly while the bag on the table is a copy. The ledger secures the record; it does not bind the record to the object. Something physical has to do that, and in practice it is a tag on the product. Once a tag is doing the binding, the question that matters is what the tag can prove, and the answer does not depend on where the record is stored.

A Vera tag goes into the product where it is made: placed inside a watch behind the dial, hidden behind a handbag's logo or in a fabric patch, or sewn into a garment's label. Behind the tag sits a certificate that belongs to that one item.

Secure tags of this kind do more than hold a number. Each time one is read, it computes a fresh cryptographic code with a key that cannot be read off the tag. A tap therefore produces evidence about the object in hand, not about a web address. A link that has been copied or screenshotted opens the certificate without the verified state, and a tap that replays an old code is recorded as invalid and shown on the certificate.

Together, a verified tap and its certificate answer three questions a token cannot answer by itself.

• This object was tagged by its maker. The tag was fitted in production and bound to its certificate there, so a genuine tap traces back to the brand, not to whoever created a record.
• Who owns it now. Ownership is recorded against the item and changes only when a transfer is accepted.
• What has happened to it. Every transfer, resale and scan is written to the same certificate, from the first sale to the latest owner.

Tokens also ask something of owners that few luxury buyers expect. A wallet is controlled by a private key, and NIST spells out the consequence: if a user loses the key, any digital asset associated with it is lost, and if the key is stolen, the thief has full access. For a token standing in for a watch, a forgotten recovery phrase means a lost provenance record, and a phished one means a stolen one.²

A certificate can work the way owners already expect. Opening it takes a phone, not an app or a wallet. Ownership moves when the current owner sends the certificate on with a code and the recipient accepts. An owner who sells can complete the sale inside the certificate, so the money and the ownership record move together. If an item is lost or stolen, the owner can mark it, and anyone who taps it afterwards sees that status. Each owner also decides whether their step appears in the public history.

Even the feature most often cited for tokens in resale, the built-in royalty, has proved weaker than it sounded. The Ethereum royalty standard states that payment must be voluntary, and in August 2023 OpenSea announced it would make creator fees optional. A brand that wants a share of resale needs agreements with whoever runs the sale, with or without a token.^3,4

The best argument for a ledger is not security. It is independence. A record kept by one company depends on that company: its systems, its honesty and its survival. A shared ledger, the argument goes, keeps the record intact whatever happens to any single operator.

It deserves a straight answer, and part of it holds. Where many parties who do not trust one another must all write to the same record, and no one can be its operator, a ledger can be the right tool. But a ledger is not free of operators either. NIST lists the idea that no one controls a blockchain among its misconceptions: permissioned networks are run by an owner or consortium that can replace blocks by legitimate means, and permissionless ones are steered by their developers and publishing nodes. It also notes that a defunct blockchain would not be suitable as a historical record.²

A product certificate is not the many-writers case. The authority on whether a brand made an object is the brand. What matters is that the brand, rather than its vendor, controls the record. With Vera, the brand owns its data and can export it in full, so its record of its products is not locked inside any one provider.

Whatever sits behind it, a product certificate should be judged on what it proves. Five questions separate a strong one from a weak one.

• What binds the record to the object? A printed code can be copied. A tag that signs each read with a key it never reveals cannot be cloned by reading it.
• Does a forwarded link look verified? If a screenshot passes as proof, the certificate is only a picture.
• Can an owner use it without new software? Every extra step is a buyer who never checks.
• What happens when something goes wrong? Lost access, stolen items and damaged tags all need a way back.
• Who holds the data, and can the brand take it with them?

Vera's answer is a certificate: a record kept for the brand and tied to the object by its tag. Brands that want an extra, independent store of record can have Vera connect a blockchain, so each certificate is also kept with a third party for posterity, and what the certificate does for the brand and the owner stays the same.

A token proves who controls an entry in a ledger. A tag and certificate prove which object you are holding, who made it and who owns it now. For a physical product, the second set of answers is the one buyers, owners and brands actually need.