A certificate is issued by the Academy server and signed with a private key. The signature is checked here against the stored record, so a certificate cannot be altered or invented. Only the credential id and its signature are checked — no personal data is required.