Why We Carry a Towel

Published on 6 October 2026 by David

Every Hitchhiker carries a towel. Ours is a small program that holds your keys, says no on your behalf, and keeps the receipts. We call it the Towel. The software underneath it is OpenVTC, and this post is about why we chose it.

It is not a story about any one trial or any one place. It is about what our community needs from a thing like this, and why this particular thing fits.

The Question Every Act Raises

A Hitchhiker today does several kinds of work at once. They write on an open-source federated research platform, inspired in large part by federated wiki, often beside an AI that runs on a machine at home. They hold a name of their own, and the key that proves it. They give and receive hours in a timebank. Some of them hold an office in the mutual, with the right to sign for it.

Each of those acts raises the same five questions. Who is acting? For whom? As which identity? With what permission? And what is the evidence afterwards?

Most software answers none of them. An API key in a config file says nothing about who typed the command. A shared password says nothing about which steward used it. A chat transcript says nothing a verifier can check. We have been living on trust-me, and trust-me does not scale past a few friends.

Where Trust Went

The institutions we were taught to trust are losing it, and the evidence is not subtle. In the United States, Pew Research Center found in 2025 that 17 per cent of people trust the federal government to do what is right most of the time, one of the lowest readings in nearly seventy years of asking. In Britain, the British Social Attitudes survey found that 45 per cent almost never trust a government of any party to put the nation before the party, a record, up from 12 per cent when the question was first asked in 1986. Across thirty OECD countries, more people now have low or no trust in their national government than have high or moderate trust. The 2025 Edelman Trust Barometer found that 69 per cent worry that government officials, business leaders and journalists deliberately mislead them, and six in ten carry what it calls grievance: a belief that the institutions serve someone else.

The same surveys show that trust has not disappeared. It has moved. The OECD finds the widest gap of all between people who feel they have a say in what government does and people who feel they do not. Trust is highest close to home, among people we know, in groups we can see working. The further a decision travels from the people it affects, the less anyone believes in it.

The institutional answer has mostly been more identity. More verification at every door, more documents to present, more data gathered about you in the name of trust. That gives the institution more certainty about you and gives you none about it. We think the problem is deeper than that. Trust is infrastructure. It is how we vouch for each other, how we hand a decision or a power to someone and for how long and within what limits, how a group makes a decision, and how it can show afterwards that it did. Those mechanisms have barely changed since paper: a signature on a form, a minute of a meeting, a name on a list, taken on faith.

We want to rebuild that infrastructure from the ground up, small enough to run in a home and plain enough to check. A receipt for every act. A mandate that anyone can verify and that expires. A membership you can prove without handing over your life. A decision that shows its route from the first conversation to the final statement. And now that we work beside machines that can be talked into things by a stranger’s text, the question of who may do what has to be answered by something sturdier than a prompt. The Towel is the piece of that infrastructure that holds the keys and keeps the receipts.

What OpenVTC Is

OpenVTC is an open-source project, written in Rust and published under the Apache 2.0 licence. It implements the Verifiable Trust Infrastructure specification from the Trust over IP Foundation. It ships two services.

The Verifiable Trust Agent holds one principal’s keys, identifiers, contexts, credentials, policies and audit trail. That is the Towel. The Verifiable Trust Community holds a community’s membership, roles, credential issuers and policy. One is agency; the other is association.

Every request to a Towel is a signed document, and the Towel decides under its policy whether to act. A policy can say that a particular act needs a human’s approval before the Towel will sign. That one feature is why we are here. It lets us make a rule and then enforce it: the AI never signs. The AI asks. The person approves. The Towel signs, and records both.

Why It Fits Hitchhikers

It runs at home. The Towel runs on a Raspberry Pi in a Hitchhiker’s own house, listening only to that machine. There is no cloud account behind it and nobody else holds a copy of the key. This is the same instinct as Your Right to a Name: the key lives with you, never with us.

It knows what a community is. Most identity software stops at the individual. We needed the community too. A mutual has offices, and an office that belongs to nobody can be used by anybody. With a Towel the office holds its own key, and its policy says when it signs: two of three stewards must ask, each signing as themselves. The office’s act is always traceable to people. Our rule follows from this. Every legal person in the federation has a Towel: each author, each author’s AI, each site, each office.

It keeps your lives apart. One person may be a member, a steward and an author. Those are different contexts in one Towel, with different keys, and a verifier who sees one cannot link it to the others. You can prove you are a member without showing which pages you wrote.

It refuses. We tested this on our own board. The Towel refuses to start if it has no identity. It refuses an unauthenticated request. When an AI agent asked to export a key, to read the access list, or to promote itself, it was refused every time, and every refusal is in the audit trail, chained so that nobody can quietly edit it.

We know what we are running. We built the same release twice, on two machines that had never met, and got the same binary to the last byte. We have the full list of its parts and a dependency policy that passes. That is a higher standard than we hold most of our own software to, and it is the standard this software has to meet.

We can give back. The code is open and the maintainers publish their own security review, including the gaps. We have drafted our first issues and one small fix. A commons that only takes is not a commons.

What It Does Not Do Yet

We keep a list of what would make us stop. One item on it has fired.

When we revoked an agent, it kept working for about thirteen minutes, because the tokens it held were self-contained and there was no way to call them back. We also found that a Towel whose identifier is its key cannot be retired if the board is lost: you can clone it, but you cannot rotate it. Both problems have known answers in the identity world, and the lab is working through which one to adopt. Recovery is not yet social, so losing a board still means a careful restore rather than asking your friends. And most of the code so far comes from one company’s engineers, which is a risk we watch.

Our own part is also unfinished. The wiki journal is the natural place for receipts, every action signed by its author’s Towel and countersigned by the site’s, and that work has not shipped. The pieces exist. The composition does not.

We say all of this because the Towel’s whole value is that it is checkable. A Towel we oversold would be worth less than no Towel at all.

Why a Towel

Douglas Adams wrote that a towel was about the most useful thing a hitchhiker could carry, and that a hitchhiker who knew where their towel was could be trusted with a good deal else. We did not pick the name for the joke. We picked it because that is exactly the test. Can you say, at any moment, who holds your keys, what they are allowed to do, and what they did? If you can, you know where your towel is.