Fragility of domain-specific digital identity assertions