for a permissionless blockchain because both certificate authorities would be open to everyone and that would allow the easy linking of anonymous identities. Another recent proposal for a decentralised PKI based on a blockchain[@cryptoeprint:2018:853] does not provide anonymity, although it improves the work on cryptographic accumulators on blockchains started by Certcoin[@certcoin; @cryptoeprint:2015:718]; another proposals introduce privacy-aware PKIs on blockchains[@pbpki; @cryptoeprint:2019:527], but they are not Sybil-resistant and do not re-use certificates from other CAs. Previously, BitNym[@sybilPseudonym] introduced Sybil-resistant pseudonyms to Bitcoin, but a Trusted-Third Party must check the real identities of users before allowing the creation of a bounded number of valid genesis pseudonyms. ChainAnchor[@chainAnchor] wasn’t Sybil-resistant and used Direct Anonymous Attestation just for anonymous authentication, but not for mutual authentication: it worked on the permissioned model, explicitly not permissionless, and the GroupOwner initially knew the true identity of members; moreover, the Permissions Issuer is supposed not to collude with the Verifier, although it has reading access to the identity database. ClaimChain[@DBLP:journals/corr/KulynychITD17] improves the decentralised distribution of public keys in a privacy-preserving way with non-equivocation properties, but it doesn’t consider their Sybil-resistance because it’s more focused on e-mail communications. Blind Certificate Authorities[@WAPRS18; @cryptoeprint:2016:925] can simultaneously validate an identity and prove a 