Website Identity Verification in the Post-EV Era: A Security Practitioner's Playbook for QWACs and AI-Agent Trust

With Halloween once again on the calendar, security teams should revisit a trust problem that shaped the modern web: the disappearance of verified business identity from the browser interface. A decade ago, the address bar displayed a green company name confirming Extended Validation. Today, that signal is buried behind clicks, visible mainly to operators inspecting certificates. The consequence for defenders—phishing actors can now present the same padlock as legitimate enterprises. As AI agents move into browsing workflows and the EU mandates Qualified Website Authentication Certificates by January, 2027, security practitioners need a clear read on how website identity verification is being rebuilt and what it means for their threat-model decisions.

Like an Agatha Christie novel, multiple culprits contributed to the collapse. The final loss: verified business identity was severed from websites. A new EU standard and the spread of AI agents may bring that identity back from the grave. Below, IT Insights breaks down the timeline, the technical architecture, and the operational checklist security teams should act on now.

From EV to DV: How the Trust Hierarchy Was Structured—and Dismantled

Website certificates operate at distinct identity-verification levels. Domain Validation (DV) establishes control of a domain and is used for encryption. Organization Validation (OV) added vetting of the organization behind it. Extended Validation (EV) required a more detailed process for verifying the legal entity, incorporating information such as incorporation jurisdiction and registration number.

Browser designers surfaced some of that data for human users. EV got prime address-bar space: in Chrome and Firefox, a company name appeared beside the URL, often in green. The deal was that a business could pay for additional verification and receive an added presentation of trust to website viewers.

That arrangement depended on customers noticing it. Humans are poor at detecting trust indicators, or their absence, so EV never fulfilled its promise as a security measure. When Chrome explained moving EV information out of the address bar in Chrome 77, it cited research showing that changing or removing the indicator did little to change users' security decisions. People would still enter sensitive information for fraudsters even when the company name was missing beside the URL.

The browsers were similarly aligned. Safari reduced EV's visibility in 2018. Firefox moved its indicator into the site-information panel in 2019.

The Identity-Collision Threat: Lessons from the Kentucky Stripe Incident

Security researchers soon proved that a company name in the browser bar alone was insufficient for establishing trust. In 2017, security researcher Ian Carroll incorporated a company called Stripe, Inc. in Kentucky and obtained a valid EV certificate for it. The widely known Stripe was incorporated in Delaware, so there was no collision at the legal-entity level. Still, both companies were shown by a browser as Stripe, Inc.

The demonstration prompted a public debate among browser-security specialists about identity information that could be accurate and still confuse users. A certificate could correctly identify Carroll's firm, which, with the company name alone, inherited the reputation of a different business.

EV certificates could carry details such as registration state to distinguish entities, but with limited browser-bar UI, that extra information was discarded. Even so, few internet users could be expected to know the incorporation jurisdiction of every company they dealt with.

Kentucky Stripe was one of the nails in the coffin. Mozilla later cited this kind of name collision among its reasons for burying the indicator behind clicks.

Free Certificates and the Encryption Paradox

Meanwhile, Let's Encrypt, a service from the nonprofit Internet Security Research Group (ISRG), was fixing a huge security problem on the web. It made basic DV certificates free for any website. Automated renewal made HTTPS practical for owners who had resisted SSL pain: fees, manual configuration, and recurring maintenance.

It worked. Let's Encrypt's tenth-anniversary account describes global HTTPS usage in its Firefox-based measurements rising from below 30% to around 80% over roughly five years. Browser changes and hosting providers helped drive that progress.

Let's Encrypt did not, and does not, issue OV or EV certificates. That posed no real concern once browsers removed the prominent EV badge, because the paid certificate and additional vetting had basically no utility.

That crushed the commercial CA industry, for which paid SSL certificates had been core business. EV and OV certificates remain on sale for niche buyers with identity, procurement, or service requirements. But paying extra to reassure ordinary visitors was effectively dead.

The Padlock Blind Spot: Why Encryption Alone Cannot Authenticate a Site

An authentic site and a phishing imitator can both get DV certificates from Let's Encrypt and pass the same TLS checks. They get the same lock icon in the browser bar, because even a fraudster can protect credit-card data in transit and prevent man-in-the-middle attacks.

Let's Encrypt explained this limitation before launching its public service. It said a CA's responsibility begins at encryption and ends at content, and that determining legitimacy is the job of others.

The lock icon's utility was questionable too. In its 2023 explanation of the lock icon's retirement, Chrome reported that only 11% of participants in a 2021 study understood its precise meaning. Chrome also noted that nearly all phishing sites used HTTPS. It replaced the address-bar lock with a settings-style icon; Safari retained the lock.

Yet in 2026, internet users still face the nagging question: who is responsible for a particular website?

QWACs and 2-QWAC: Rebuilding Verified Identity in a Regulated Trust Framework

The EU never let go of the idea that websites should have identity behind them. Qualified Website Authentication Certificates, or QWACs, provide a foundation for bringing verified business identity back into browsing. As of January, 2027, browsers are required to support it.

Like an EV, QWACs carry verified identity data, but within the EU's regulated trust ecosystem instead of leaving it to browser companies. Unlike EV, in the new 2-QWAC approach, that identity lives in a separate certificate, cryptographically linked to the website's ordinary TLS certificate.

The separation of concerns means a site can keep its existing HTTPS setup, including a free Let's Encrypt certificate or subscription, and add identity as an optional component.

This architecture gives owners a useful combination: free, automated connection security and independently checked business identity for users.

AI Agents as a New Verification Audience

But what about the objection that humans do not pay attention to certificates? In 2026, AI agents offer a very different audience. Human attention is limited, but software can programmatically check identity claims on every visit, examine available attributes, and compare them with a known trust list. An LLM's attention budget can take in more than a green label squeezed beside a URL.

Think back to the two Stripes. A personal AI agent could compare the certified entity's jurisdiction in QWAC certificate metadata with a trusted record of the intended merchant, then flag a mismatch to the human user.

The verification infrastructure will already be part of browsing software as of January. An agent could extract identity data, use it when evaluating a transaction, and make it available to the person approving the purchase. That is not to say identity will stop internet fraud, but identity gives the agent a missing piece of evidence for a holistic website legitimacy evaluation next to signals such as reputation or PageRank.

EV's old bargain asked a distracted human to notice a small label and make a better decision. If AI agents, not humans, become the primary web browsers, the equation changes. AI agents and 2-QWACs change the cost and value of publishing verified identity, and may give businesses a reason to invest in it again.

Security Practitioner Checklist: Preparing for the QWAC Transition

• Certificate inventory audit: Catalog every public-facing certificate by type (DV, OV, EV) and issuer; flag sites still relying on EV for browser-level identity display that will lose that rendering as Chrome, Firefox, and Safari enforce QWAC support by January, 2027.
• Let's Encrypt / ISRG dependency review: Confirm which domains currently use free DV certificates from Let's Encrypt; evaluate whether those domains require verified business identity under the EU trust framework.
• 2-QWAC readiness assessment: Verify that your certificate lifecycle management tooling can provision and rotate the separate identity certificate required by the 2-QWAC model without disrupting existing TLS handshakes.
• Identity-collision screening: Register the organization's legal name and incorporation jurisdiction (analogous to the distinction between Stripe, Inc. in Delaware versus Stripe, Inc. in Kentucky) to prevent bad actors from obtaining lookalike QWACs.
• AI-agent trust-list preparation: Publish authoritative entity metadata (jurisdiction, registration number) so that AI agents can programmatically compare QWAC attributes against a known-good record.
• Phishing-simulation update: Refresh phishing awareness campaigns to remove references to the green EV badge or padlock icon, and instead train users to inspect certificate chains and verified identity panels.
• Vendor and CA contract review: If your organization holds legacy EV contracts, assess whether the commercial CA's offerings align with the EU QWAC ecosystem or whether a transition to a qualified trust-service provider is needed.

Common Misconceptions About Website Identity and Encryption

• "The padlock means the site is legitimate." Only 11% of participants in the 2021 study understood the lock's precise meaning; Chrome retired it in 2023, and Safari retained it, creating cross-browser confusion. Encryption protects data in transit; it does not authenticate the entity behind the page.
• "Let's Encrypt certificates are less secure." A DV certificate from Let's Encrypt encrypts traffic identically to a paid certificate. The gap is identity verification, not cryptographic strength.
• "EV was removed because certificates were technically weak." EV certificates were valid; they were removed because research showed users ignored the trust indicator, and because the Kentucky Stripe demonstration proved that company-name display could mislead even when accurate.
• "QWACs will make phishing disappear." The EU framework restores verified identity as an evidence layer, but identity alone cannot eliminate fraud—it complements signals such as reputation or PageRank.
• "AI agents eliminate the need for human vigilance." Agents can programmatically check identity claims, but security teams must still supply accurate trust lists and entity metadata for comparison.

Comparing EV, QWAC, and 2-QWAC Architectures for Security Teams

Dimension	Legacy EV	QWAC (EU)	2-QWAC
Identity data location	Same certificate as TLS	Same certificate as TLS	Separate certificate, cryptographically linked to TLS cert
Governing body	Browser vendors (Chrome, Firefox, Safari, Mozilla)	EU regulated trust ecosystem	EU regulated trust ecosystem
Browser display	Green name in address bar (removed)	Required support as of January, 2027	Required support as of January, 2027
Encryption dependency	Paid cert bundled encryption + identity	Can use free Let's Encrypt DV cert + separate QWAC	Same: separation of concerns
AI-agent verifiability	Limited—browser UI only	Metadata queryable programmatically	Metadata queryable programmatically
Identity-collision risk	Demonstrated by Ian Carroll / Kentucky Stripe	Jurisdiction + registration number in regulated record	Jurisdiction + registration number in regulated record

Frequently Asked Questions

Why did Chrome, Firefox, and Safari remove the EV indicator?

Chrome explained the shift in Chrome 77 by citing research showing that users did not alter security decisions based on the green label. Safari reduced EV's visibility in 2018; Firefox moved its indicator into the site-information panel in 2019. Mozilla later cited name-collision cases like Kentucky Stripe among its reasons.

Does Let's Encrypt provide identity verification?

No. Let's Encrypt, operated by Internet Security Research Group (ISRG), issues only DV certificates. It made basic certificates free, driving HTTPS from below 30% to around 80% in roughly five years according to its tenth-anniversary Firefox-based measurements. The CA explicitly stated that its responsibility begins at encryption and ends at content.

What is the practical difference between QWACs and the older EV model?

QWACs carry verified identity data within the EU's regulated trust ecosystem rather than depending on browser-vendor display choices. In the 2-QWAC approach, identity lives in a separate certificate linked to the site's TLS certificate, allowing a site to keep its existing Let's Encrypt setup and add identity as an optional layer.

How do AI agents use QWAC data to reduce fraud?

In 2026, AI agents can programmatically check identity claims on every visit. For example, referencing the two Stripes incident, an agent could compare a QWAC's jurisdiction metadata against a trusted merchant record and flag mismatches to the human user—something that was impossible when the only display was a green label beside the URL.

Is the verified-identity problem relevant outside the EU?

The EU mandate for browser QWAC support takes effect as of January, 2027, but the identity-collision and phishing-encryption issues apply globally. Two companies with the same name can obtain valid certificates in different jurisdictions (Kentucky and Delaware, for example), and nearly all phishing sites now use HTTPS.

Action Recommendations for Security and IT Operations Teams

1. Map certificate-type exposure now. Identify every domain where users perform authentication, payment, or data submission. For those in scope, determine whether the current certificate (DV, OV, or EV) will satisfy QWAC requirements by January, 2027.
2. Pilot 2-QWAC deployment with your existing TLS stack. Because the 2-QWAC model attaches identity as a separate cryptographically linked certificate, test provisioning alongside your current Let's Encrypt or commercial CA setup before the EU browser mandate arrives.
3. Integrate QWAC metadata into threat-intelligence pipelines. Configure AI-agent trust lists to query certificate jurisdiction and registration-number fields; this addresses the identity-collision gap that the Kentucky Stripe proof-of-concept exposed in 2017.
4. Rewrite user-facing security guidance. Remove references to the green badge and padlock. Train staff and customers to access the site-information panel in Chrome, Firefox, and Safari to inspect verified entity data.
5. Engage a qualified EU trust-service provider. The legacy commercial CA industry that sold EV certificates no longer guarantees browser-level identity display; QWACs operate within the EU's regulated ecosystem, requiring coordination with a qualified provider.
6. Update phishing-response playbooks for AI-agent channels. As AI agents become primary web browsers, defenders must also prepare for agents being manipulated by spoofed identity metadata; include QWAC verification steps in incident-response runbooks.

Closing: Website Identity May Yet Rise from the Grave

From the initial EV promise through Let's Encrypt's encryption-for-all revolution and the AI-agent verification frontier, the security community has watched verified business identity on the web fall apart and begin a structured rebuild. For enterprise defenders, the operational takeaway is unambiguous: encryption has been solved, but identity has not—until QWACs and 2-QWAC create the regulated, programmatically verifiable layer that the green badge was never able to deliver on its own. Security teams that inventory certificates, stress-test the 2-QWAC architecture, and update threat models before January, 2027 will be positioned to turn browser-level identity data into an active defensive signal rather than a historical footnote.