Hi all,
I’ve been working through a problem that keeps coming up in rural health deployments: clinics with MOSIP-based national ID (specifically thinking about Ethiopia’s Fayda rollout) often have unreliable or zero connectivity, which breaks cloud-dependent identity verification exactly when it’s needed most.
I put together an open-source architectural spec exploring one approach — offline signature verification of signed ID tokens using a pre-loaded public key bundle, translation into HL7 FHIR Patient resources, and a store-and-forward sync queue for when connectivity returns.
It’s explicitly a spec/PoC, not production code, and I’ve tried to be upfront about its limitations — there’s a dedicated threat-model doc covering things like offline revocation lag, clock trust, and key rotation gaps that I don’t think this architecture fully solves yet.
I’d genuinely value critique from people closer to MOSIP internals than I am — particularly on whether the offline verification approach is realistic given how Claim 169 / CWT tokens actually work in practice, and whether the FHIR mapping holds up against real-world eSignet payloads.
Repo: [https://github.com/arfaneliyas1/mosip-fhir-offline-bridge\]
Threat model specifically, if you want to skip straight to the interesting part: docs/05-threat-model.md
Open to being told this is wrong in interesting ways.
