I should clarify. The credentials are anonymous even given a malicious CA. This is a cryptographic guarantee assuming the Strong RSA assumption holds. The onl

I should clarify. The credentials are anonymous even given a malicious CA. This is a cryptographic guarantee assuming the Strong RSA assumption holds. The only thing the CA can do is produce a list of people they issued credentials too.