The Model Context Protocol - Identity extension, known as MCP-I, has moved out of a single vendor's hands and into standards-body governance. In March 2026, Vouched formally donated the MCP-I framework to the Decentralized Identity Foundation, where it is now stewarded by the DIF's Trusted AI Agents Working Group. That matters because MCP-I isn't just another auth wrapper — it uses W3C Decentralized Identifiers and Verifiable Credentials to let two parties cryptographically verify each other's agents and human principals without any prior coordination or shared registry. The framework is built around four questions any service should be able to answer before it lets an agent act: who is the agent, who does it act for, what is it authorized to do, and can that authorization be checked independently of the platform that issued it. Answering those questions with DIDs and VCs, rather than with a bearer token from a single vendor's identity provider, is the actual design bet — it shifts trust away from 'this platform vouches for the agent' toward 'this credential can be verified by anyone holding the right public key.' The donation follows a pattern already visible with MCP itself: Anthropic released MCP in November 2024, then handed it to the Agentic AI Foundation under the Linux Foundation by December 2025, with OpenAI, Block, AWS, Google, Microsoft, Cloudflare, and Bloomberg signing on as founding or platinum members. MCP-I's move to DIF is the identity-layer counterpart to that handoff — the working protocol becomes neutral infrastructure rather than a single company's roadmap item. What's still unresolved is deployment. The standards community produced more agent-identity governance specifications in the first half of 2026 than in the field's entire prior history, but the vendor landscape responding to those specs has already fragmented into four different categories — identity providers, credential-security tools, control-plane platforms, and non-human-identity specialists — each solving a different slice of the problem. A DID-based credential that any verifier can check is only as useful as the number of relying parties actually willing to check it. Handing MCP-I to a foundation is a governance move, not a proof that enterprises will wire it into their checkout, procurement, or CI systems. The next signal to watch is which major platforms start issuing or verifying MCP-I credentials in production rather than just supporting the spec on paper.