I take precisely zero credit for this but the W3C Verifiable Credentials WG that I have the privilege to co-chair has just published a bunch of Threat Models. That is, a series of docs that literally answer the question:

What could possibly go wrong?

VCs are all about proof and provenance. They're a target for bad actors so here's what the WG has worked on to defend against attacks https://www.w3.org/news/2026/first-draft-notes-verifiable-credential-threat-models/

Kudos to Manu, Simone, Joe and others. And to @w3c for this process step.