Issuer Sign-In

Phase 2A: pre-canned demo issuers. Phase 3 swaps this for KYB onboarding + FIDO2 hardware keys backed by the on-chain ERC-735 issuer whitelist.