do we really want to limit credentials to just users? authorities need them too.