@AnttiHaapala this.. where the DID controller's trusted third parties need to override malicious activity by an attacker. See Section § 9. Security Considerations . ...
w3c.github.io/did-core/#authorization-and-delegation what could possibly go wrong?