Let us unpick decentralised systems and multiple issuers a bit more. There is another dimension we have to consider, and that is one of trust.

In VC systems there are always multiple issuers, and those issuers can share a single decentralised system (a DLT). But for any particular VC there is only one issuer and the trust rules of the verifier will determine who it trusts to issue any particular type of VC. If each VC issuer issues its own type of VC, then there will never be multiple issuers of that type of VC on the DLT. That VC will be issued from one source (a centralised issuer, if you like) even though the entire VC system is decentralised, and there are multiple VC Issuers in the eco-system.

Even if we have multiple VC issuers of a single type of VC (as we are likely to have in the COVID case), this can still be coordinated outside of the DLT in the trust framework, so that effectively the issuing of this type of VC is coordinated in a centralised way in the trust framework, which is orthogonal to the DLT which stores the meta information. This stops anyone such as myself from deciding I will issue valid COVID VCs. I might issue them, but no verifier would trust them.

Ultimately the verifier's trust rules will determine whether there are multiple issuers of the same type of VC or not, and how those issuers are identified. We have many examples today of multiple issuers issuing the same type of credential. Credit cards are the obvious one. Introducing a DLT into the credit card network, eg. so that every actor could have a copy of the entire database, would not alter the trust rules for which card issuers were trusted to issue credit cards.

 The trust framework will determine which VC issuers are to be trusted, and how verifiers can determine this. This may be regarded as a centralised control system, or registry, as Orie suggests