Ensure that credential storage should be encrypted using strong entropy sources

[msporny]

From this article:

https://arstechnica.com/information-technology/2022/05/digital-drivers-license-used-by-4m-australians-is-a-snap-to-forge/

One of the security failures above was that the app used a 4-digit PIN to encrypt the driver's license. I would hope that those doing client-side encryption for digital wallets would use an encryption key from a proper entropy source. Granted, if the credential was digitally signed in the first place, it couldn't be tampered with, but we should be treating all data in a digital wallet as something you don't want falling into the hands of anyone that has access to the data on your phone (like your backup provider). There is also the question around proper protection of private key material. I know that some of the digital wallets in our space don't protect their private keys at all, and that's a problem that's going to come back and bite our community.

Credential storage should be encrypted using strong keys from cryptographically safe entropy sources. Private keys should be hardware-backed if at all possible, and if not, encrypted when not in use (using strong keys from cryptographically safe entropy sources).