Guardians of the Registry: Certificate Transparency for Relying Party Authorization in eIDAS 2

User-centric, privacy-preserving identity wallets---such as those defined under the EU Digital Identity~(EUDI) framework---control access to their ecosystem by requiring Relying Parties (RPs) to authenticate and declare their data access permissions. Under eIDAS 2, this is realized through two certificates: Access Certificates (RPACs), which authenticate individual service instances, and Registration Certificates (RPRCs), which specify the attributes a service is permitted to request. However, in the absence of auditability, misissuance and silent revocation of these certificates remain undetectable—undermining user trust and regulatory oversight.
To address this gap, we propose RP Certificate Transparency (RPCT): a transparent logging architecture that records both issuance and revocation of RP certificates in an append-only, publicly auditable log. By adapting Certificate Transparency (CT) principles to the EUDI context, RPCT enables monitoring of issued certificates and detection of overly permissive authorizations. Our design addresses known CT limitations, such as lack of revocation transparency, privacy leakage, and monitoring overhead, and adds support for offline-verifiable proofs that preserve user unlinkability.
We demonstrate that our architecture meets the regulation's accountability, auditability, and privacy goals. More generally, our architecture represents an efficient, general-purpose transparency service that can be applied to any user-centric credential system.