A protocol for verifying AI agents and the humans behind them has moved out of one vendor's hands and into a standards body. According to reporting on the shift, Vouched donated the Model Context Protocol – Identity (MCP-I) framework to the Decentralized Identity Foundation in March 2026, where it's now stewarded by the DIF Trusted AI Agents Working Group. The rename matters as much as the donation. The spec is now called KYA-OS — Know Your Agent Operating System — a label meant to signal that its scope has grown past MCP specifically. The technical core hasn't changed: KYA-OS still uses Decentralized Identifiers and Verifiable Credentials to let two parties cryptographically verify both an agent and its human principal, without needing to have coordinated in advance. That last part is the interesting design constraint. Most agent-identity schemes assume some prior relationship — a shared registry, a common issuer, a bilateral trust agreement. KYA-OS is built for the opposite case: an agent shows up at a service it's never talked to before, and the service needs to know who's actually behind it before granting access. DIDs give it a portable identifier that doesn't depend on any single platform; VCs give it a way to carry proof of attributes — capabilities, ownership, authorization scope — that the receiving party can check cryptographically rather than take on faith. Handing the spec to DIF is also a bet on longevity. A framework controlled by one vendor lives or dies with that vendor's roadmap and incentives. A framework stewarded by a working group with existing DID/VC expertise has a better shot at surviving vendor churn and getting picked up by others who don't want to depend on a single company's identity layer. It puts KYA-OS in the same institutional lane as other DID-based efforts — the kind of neutral-ground move that's usually a precondition for something becoming an actual interoperability standard rather than a one-company feature. This lands squarely in the identity gap that keeps surfacing across agent-security writing this year: agent impersonation is a named threat category in frameworks like CSA's MAESTRO, and the standard mitigations — trusted registries, cryptographic identities, scoped tokens — all presuppose that an agent's identity claim can actually be checked. KYA-OS is one more entrant trying to be the thing that gets checked against. Whether it becomes the de facto answer or one of several competing DID-based schemes agents have to support is still open; DIF stewardship buys it credibility, not adoption.