The verifiable presentation is not just the credential; it should be signed by the holder, and that can include a 'domain' to specify the intended recipient and

The verifiable presentation is not just the credential; it should be signed by the holder, and that can include a 'domain' to specify the intended recipient and a challenge token to guard against replay. https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-example https://www.w3.org/TR/vc-data-model/#concrete-lifecycle-exam... It's always contingent on the recipient of an identity proof to verify that it's valid; I'm not sure I understand the criticism to be honest.