that identities are anonymised, but the parties/gatherings used to anonymise and incorporate identities into the blockchain don’t scale to national/international populations and could compromise Sybil resistance because it’s trivial to get multiple identities by using different disguises on different parties/gatherings (i.e., they need to be validated simultaneously and without disguises): however, the present paper produces Sybil-resistant, anonymised identities on a global scale for a permissionless blockchain. Moreover, Proof of Personhood[@pop] is endogenizing all the costly process of credential verification and issuing: by contrast, Zero-Knowledge Proof of Identity is exogenizing/outsourcing this costly process to governments, thus making the entire blockchain system cheaper. More recently, Private Proof-of-Stake protocols[@cryptoeprint:2018:1105; @cryptoeprint:2018:1132](PPoS) achieve anonymity, but the economic inefficiencies of staking capital still remain and the identities have no relation to the real world.

A conceptually close work (“*Decentralized Multi-authority Anonymous Authentication for Global Identities with Non-interactive Proofs*”, [@cryptoeprint:2019:701]), concurrently developed, doesn’t reuse real-world certificates and therefore it would require that governments re-issue the cryptographic credentials of their citizens: therefore, it doesn’t consider neither Sybil-resistance nor blockchain integration. Pseudo-anonymous signatures[@pseudoanonymousSignatures] for identity documents provide an interesting technical solution to the problem of anonymous authentication using identity documents. However, the proposed schemes present a number of shortcomings 