Argument Map
Who Bears the Democratic Cost When Digital Wallets Arrive
Civic Burden 的分配正義分析
The design shift from issuer-centric (MOICA) to holder-centric (TW DIW) redistributes civic burden across four dimensions (comprehension / verification access / trust judgement / dispute liability). Without accompanying safeguards, this redistribution violates the dual necessary conditions CB-Justice = D₁* ∧ D₂* of Rawls's Difference Principle and Anderson's relational equality. Taiwan's quantitative estimates project a median exclusion of 3.2–4.8 million people without mitigation; with three-tier compulsory reinforcement in place, this falls to 0.65–1.1 million.
CB-Justice = D₁* ∧ D₂*; necessary but not sufficient; compulsory reinforcement divided into soft/hard dual-track three tiers.
CB-Justice ⇔ D₁* ∧ D₂*
D₁* (Rawls, lexical): S passes D₁* iff
(i) ¬violate(S, basic_liberties)
(ii) ¬violate(S, FEO)
(iii) ∀ G_w : primary_goods(G_w, t₁) ≥ primary_goods(G_w, t₀)
D₂* (Anderson): S passes D₂* iff
(i) ¬oppression(S, ∀ groups)
(ii) ¬strip(S, common_citizenship)
(iii) ¬weaken(S, social_equal_standing)
C₁ (soft) ∧ C₂ (hard) ∧ C₃ (dual-track) → mitigate(burden_shift)
The CB-Justice dual criterion is a necessary but not sufficient condition — even if both criteria are satisfied, failure remains possible on the dimensions of Hayekian dispersed knowledge, Sen's capability approach, recognition justice, and intergenerational equity.
D₁*- Rawls's Difference Principle in lexical order (including basic liberties + FEO fair equality of opportunity + primary goods for the least advantaged)
D₂*- Anderson's relational equality in democratic citizenship version (no oppression + common citizenship + social standing parity)
G_w- The least-advantaged group (elderly / low digital literacy / no smartphone / mobile population / disability)
t₀, t₁- State before design transition S / stable state after (with safeguards in place)
C₁ / C₂ / C₃- Three-tier compulsory reinforcement conditions (soft compulsion UX / hard compulsion verifier certification / dual-track compulsion dispute adjudication)
C₄- Single-portal political choice (not included in the core abductive set)
The formula provides the normative precondition. The first step is to distinguish two conflated design orientations: placing accountability on the issuer (MOICA) versus placing it on the holder (TW DIW). The latter is not inherently superior — it requires accompanying safeguards to avoid shifting costs onto the most vulnerable.
Holder-centric design is inherently superior
"Holder-centric design returns control to users and is therefore progressive." This orientation assumes holders have the capacity to bear the costs shifted to them (comprehension / verification / trust / dispute), treating an asymmetric burden as a neutral fact. Singapore SingPass (issuer-centric) is a high-UX counterexample; NIST SP 800-63-4 ipd lists holder-centric wallets as "one option" rather than the single optimum.
holder_centric ⊨ optimal(∀ users) ❌ no empirical basis CB-Justice = D₁* ∧ D₂* (necessary, not sufficient)
Holder-centric normative superiority is a normative claim that must pass the dual necessary conditions of D₁* (primary goods of the least advantaged must not decline) and D₂* (common citizenship must not be stripped). The three-tier compulsory reinforcement conditions (C₁ soft compulsion UX / C₂ hard compulsion verifier certification / C₃ dual-track compulsion dispute adjudication) are the engineering obligations required to honour the normative claim.
holder_centric_valid ⇔ D₁* ∧ D₂* ∧ C₁ ∧ C₂ ∧ C₃ The distinction itself is merely a declaration. To demonstrate that the CB-Justice dual criterion is the normative precondition for holder-centric design, five independent supports are needed: a survey of civic burden across four dimensions, deduction of the Rawls + Anderson dual criterion, three-tier compulsory reinforcement, Taiwan's quantitative exclusion estimates, and comparison across seven cross-national cases.
§2 — Redistribution of Civic Burden across Four Dimensions
Comprehension / Verification / Trust / Dispute
whyProvides the empirical anchor — if civic burden is an abstract concept, the first step is to see the four concrete dimensions across which it is redistributed.
(1) Comprehension burden (issuer centralised education → holder individual); (2) verification access burden (central API → verifier self-integration); (3) trust judgement burden (central trust list → distributed judgement by holder + verifier); (4) dispute liability attribution (clear binary → multi-party ambiguity). Issuer-centric / holder-centric is a liability distribution spectrum (not a binary opposition) — TW DIW's trust list remains legally authorised by the public sector.
burden_redistribution(S) = ⟨comprehension, verification, trust, dispute⟩ with asymmetric impact on G_w §3 — Rawls + Anderson Dual Criterion
Deduction of D₁* ∧ D₂*
whyProvides the normative precondition — without a formalised dual criterion, "unfair" is mere intuition; only by conjoining Rawls's D₁* and Anderson's D₂* as necessary conditions does "holder-centric must pass" become a testable proposition.
D₁* (lexical order) + D₂* (democratic citizenship) as conjunctive necessary conditions. Rawls's Difference Principle requires that the primary goods and the social bases of self-respect of the least advantaged must not decline; Anderson's relational equality requires no structural oppression, common citizenship, and parity of social standing. The conjunctive dual criterion provides complementary coverage: DP addresses distribution; DE addresses relations.
CB-Justice ⇔ D₁* ∧ D₂* (necessary, not sufficient) §4 — Three-Tier Compulsory Reinforcement
C₁ Soft Compulsion / C₂ Hard Compulsion / C₃ Dual-Track Compulsion
whyProvides engineering obligations — the dual criterion is the normative precondition, but delivering on it requires concrete reinforcement at the engineering level. The three-tier compulsory reinforcement translates normative requirements into enforceable obligations.
C₁ privacy-by-default UX (soft compulsion: relying on nudge norms + WCAG 2.2 / Section 508 + Hartzog 2018 design-as-law); C₂ verifier certification system (hard compulsion: eIDAS 2.0 qualified TSP + ETSI EN 319 401 / 411); C₃ unified dispute adjudication body (dual-track compulsion: Consumer Protection Act 1994 / Personal Data Protection Act 2010 / Administrative Litigation Act). Elderly-friendly design broken down into cognitive / sensory / operational three tiers.
C₁ (soft) ∧ C₂ (hard) ∧ C₃ (dual-track) ⇒ burden_absorbed(S, G_w) §5 — Taiwan Quantitative Exclusion Estimates
Three-Tier Thresholds + Counterfactual Reduction
whyProvides causal argument + quantitative evidence — if D₁* is a normative requirement, quantitative analysis is needed to see how many people would be excluded without mitigation; otherwise the claim remains abstract.
Three non-overlapping threshold tiers: A device threshold 3.4 million / B digital literacy 1.65 million / C cognitive and physical 0.95 million; median 6 million (strict summation) / 3.2–4.8 million (conservative adjusted). Counterfactual D all three reinforcements in place (paper-based + customer service + authorised proxy) reduces this to 0.65–1.1 million, a 72.5–83.8% reduction. Remaining exclusion consists primarily of those with severe cognitive disabilities, remote-dwelling isolated individuals, and new residents and migrant workers.
exclusion_population(t₀ no_compensation) ∈ [320, 480] × 10⁶ | with C₁∧C₂∧C₃: [65, 110] × 10⁶ §6 — Five Boundary Conditions + Commercial vs. Government Obligations
Seven Cross-National Cases + Normative Category Distinction
whyProvides cross-national comparison + normative category distinction — without cross-national testing, CB-Justice risks being misread as Western-centric; without distinguishing commercial wallet from government wallet obligations, normative misapplication will arise.
Nordic BankID (D₁* ∧ D₂* both satisfied, special conditions) / Estonia X-Road / Singapore SingPass (issuer-centric counterexample) / India Aadhaar (partial failure) / France FranceConnect (partial D₂* violation) / USA Login.gov (fragmented failure) / South Korea mobile ID (emerging). Five boundary conditions B1–B5: commercial vs. government wallet normative category distinction / civic education investment / KYC interface pathway / multi-dimensional digital divide intersection / legal status of alternative pathways.
duty(commercial_wallet) ⊨ {contract, consumer_protection, arbitration} ≠ duty(government_wallet) ⊨ {admin_procedure, public_service, state_compensation} Once the five pillars are established, the quantitative component requires a concrete causal chain. Taiwan's three-tier thresholds (A device / B digital literacy / C cognitive and physical) project a median exclusion of 3.2–4.8 million without mitigation; with all three reinforcements in place this falls to 0.65–1.1 million (a 72.5–83.8% reduction).
Three-Tier Thresholds + Counterfactual Reduction
⇒ Mechanistic necessity (demographics + device penetration) ◊⇒ Probabilistic (contingent on quality of policy implementation) Counter-arguments centre on three claims: "holder-centric is inherently superior," "cost transfer is a neutral phenomenon," and "consumer protection equals regulatory suppression." Examining the empirical basis of each reveals that they all demonstrate different forms of "collapse without safeguards."
Counter-argument 1
Holder-centric design is inherently superior
pivotThe counter-argument claims that "returning control to users is progress." But SingPass is issuer-centric yet achieves high UX; NIST SP 800-63-4 lists subscriber-controlled wallets as "one option" rather than the single optimum; Cavoukian 2009 PbD emphasises that "by design" requires institutional support and is not automatically achieved by wallet UI.
The counter-argument reveals: normative superiority is a normative claim that requires D₁* ∧ D₂* + C₁ ∧ C₂ ∧ C₃ to be honoured at the engineering level.
Counter-argument 2
Cost transfer is a market mechanism
pivotThe counter-argument claims that "shifting costs will incentivise user self-education and wallet provider competition." However, data from ENISA and TW DIW pilot programmes consistently show that market mechanisms do not automatically absorb the costs borne by vulnerable users; Sasse & Flechais 2005 long demonstrated that designs pushing security responsibility onto users ultimately result in system failure.
The counter-argument reveals: cross-platform non-portability is a consequence of platform lock-in, unrelated to market efficiency; a 22% onboarding failure rate among users aged 65+ is counter-evidence against the market mechanism claim.
Counter-argument 3
Consumer protection equals regulatory suppression
pivotThe counter-argument claims that "mandatory verifier certification raises compliance costs and stifles startups." But consumer protection legislation is a 30-year accumulation of civil society consensus since 1994; EU eIDAS 2.0 regulation of wallet providers has not suppressed innovation — clear regulation has reduced uncertainty for relatively smaller vendors.
The counter-argument reveals: consumer protection is necessary infrastructure for market operation, not the market's opposite; Solove & Hartzog 2014's observations on the FTC confirm this argument.
Once the counter-arguments are absorbed, what remains are the specific design obligations of the three-tier compulsory reinforcement conditions C₁ / C₂ / C₃, together with five boundary conditions B1–B5.
Three-Tier Compulsory Reinforcement Conditions C₁ ∧ C₂ ∧ C₃
∀ holder_centric S : valid(S) ⇒ C₁ ∧ C₂ ∧ C₃ (necessary)Nudge norms + WCAG 2.2 SC 1.4.3 contrast 4.5:1 / 1.4.4 text 200% / 1.4.10 reflow / 2.5.7 dragging movements / 2.5.8 target size 24×24 pixels + Section 508 + W3C ATAG/UAAG. Elderly-friendly design decomposed into cognitive / sensory / operational three tiers.
C₁: ∀ wallet UX : default = minimal_disclosure ∧ WCAG_2.2_AA(UX) eIDAS 2.0 qualified TSP must be certified by a conformity assessment body + ETSI EN 319 401 + 411-1 + 411-2 + ISO/IEC 27701 / 29115. Taiwan's existing Consumer Protection Act + Personal Data Protection Act framework can carry this obligation.
C₂: ∀ verifier v : qualified(v) ⇒ accredited_by(CAB, v) ∧ ∈ trust_list Consumer Protection Act Arts. 43–47 (complaint → mediation → class action) + Personal Data Protection Act Arts. 28–31 statutory damages + Administrative Litigation Act / Petition Act (government wallet) / Civil Code Art. 184 + Arbitration Act (commercial wallet) + EU ADR Directive 2013/11.
C₃: ∀ dispute d : ∃ unified_forum(d) ∧ effective_remedy(d) B1 weak-identity-document states / B2 Aadhaar lessons / B3 shared device / B4 multi-rooted conditions satisfied / B5 cross-jurisdictional recognition spectrum.
valid(deployment) ⇔ ⋀ⱼ Bⱼ (j ∈ 1..5) The pivotal variable in Nordic BankID's success, but involves sovereign choice and path dependence of governance history; not included in the minimal engineering-sociological set.
C₄: optional but pivotal in Nordic case Commercial wallet (contract + consumer protection + arbitration) vs. government wallet (rule of law + public service + state compensation); this is a normative category difference, not a difference of degree; applying the same obligation framework to both produces normative misapplication.
duty(commercial_wallet) ≠ duty(government_wallet) (categorical, not gradient) The dual criterion + three-tier reinforcement + quantitative exclusion + five boundaries + cross-national comparison converge on: holder-centric normative superiority is a normative claim, not an engineering fact; safeguards must come first if the promises of autonomy are to be honoured.
From MOICA to TW DIW, from issuer-centric to holder-centric, the democratic cost is redistributed across four dimensions. The CB-Justice dual criterion composed of Rawls's Difference Principle and Anderson's relational equality shares a conjunctive structure with article 03's H1' three walls, article 04's T three-part conjunction, article 05's IT' impossibility triangle, and article 07's SRP — but operates at different levels; CB-Justice is the normative precondition for holder-centric design transitions, requiring that the primary goods and democratic citizenship of the most vulnerable must not be stripped away.
The three-tier compulsory reinforcement conditions (C₁ soft compulsion UX, C₂ hard compulsion verifier certification, C₃ dual-track compulsion dispute adjudication) must all be in place simultaneously; Taiwan's quantitative estimates project a median exclusion of 3.2–4.8 million people without mitigation, falling to 0.65–1.1 million with all three reinforcements in place — a 72.5–83.8% reduction.
The normative superiority of holder-centric design is not an engineering fact; for the promises of autonomy, minimal disclosure, and composability to be genuinely honoured, safeguards must come first, and the legal status of paper-based, customer service, and authorised proxy alternative pathways must be explicitly guaranteed by legislation.
Final form:
CB-Justice ⇔ D₁* ∧ D₂* (necessary, not sufficient)
holder_centric_valid ⇔ CB-Justice ∧ C₁ ∧ C₂ ∧ C₃ ∧ ⋀ⱼ Bⱼ
duty(commercial) ≠ duty(government) (categorical)
Taiwan: "exclusion(no_compensation) ∈ [320, 480]M → with C₁∧C₂∧C₃: [65, 110]M"
Source
===
title: 數位皮夾把民主成本下放給誰
subTitle: Civic Burden 的分配正義分析
slug: 2026-05-05-civic-burden-redistribution
author: research-article-pipeline argdown export
model:
removeTagsFromText: true
===
# Central Thesis
[Core Thesis]
+ <Formal Core>
+ [Accepted]
+ <P1>
+ <P2>
+ <P3>
+ <P4>
+ <P5>
+ <Causal Chain>
+ [Deployment Conditions]
+ <Conclusion>
- [Rejected]
- [Accepted]
+ [Accepted]
- [Objection 1]
- <Reply 1>
+ <Reply 1>
- [Objection 2]
- <Reply 2>
+ <Reply 2>
- [Objection 3]
- <Reply 3>
+ <Reply 3>
[Core Thesis]: 從 issuer-centric（MOICA）轉向 holder-centric（TW DIW）的設計選擇，會在四個面向重新分配 civic burden（理解 驗證接入 信任判斷 爭議責任）。這種重新分配在缺乏配套時違反 Rawls 差別原則 Anderson 關係平等的雙重必要條件 CB-Justice D₁ D₂ 。台灣量化估計顯示無補強下中位排除 320-480 萬人 三項分層強制補強齊備可降至 65-110 萬。 #thesis
<Formal Core>: Formula CB-Justice D₁ D₂ D₁ (Rawls, lexical) S 通過 D₁ iff (i) violate(S, basic liberties) (ii) violate(S, FEO) (iii) G w primary goods(G w, t₁) primary goods(G w, t₀) D₂ (Anderson) S 通過 D₂ iff (i) oppression(S, groups) (ii) strip(S, common citizenship) (iii) weaken(S, social equal standing) C₁ (soft) C₂ (hard) C₃ (dual-track) mitigate(burden shift) Caption CB-Justice 雙重判準是必要而非充分條件——即便雙重判準滿足，仍可能在 Hayek 知識分散、Sen capability、認可正義、跨世代維度失敗。 #formal
[Accepted]: CB-Justice D₁ D₂ （必要非充分）. holder-centric 規範優越是規範性主張，需通過 D₁ （最不利者基本益品不下降） D₂ （共同公民身分不被剝奪）雙重必要條件。三項分層強制補強條件（C₁ 軟強制 UX C₂ 硬強制 verifier 認證 C₃ 雙軌強制爭議裁決）是兌現規範優越的工程義務。 #accepted
[Rejected]: holder-centric 天然優越. 「holder-centric 設計把控制權還給使用者，所以是進步。」這個取向假設 holder 有能力承擔被下放的成本（理解 驗證 信任 爭議），把不對稱負擔當成中性事實。Singapore SingPass（issuer-centric）是高 UX 反例 NIST SP 800-63-4 ipd 把 holder-centric 列為「一種選項」而非單一最優。 #rejected
<P1>: Title 理解 驗證 信任 爭議 Section 2 — 四面向 civic burden 重新分配 Role 提供經驗錨點——若 civic burden 是抽象概念，需要先看具體在哪四個面向被重新分配。 (1) 理解負擔（issuer 中央教育 holder 個人） (2) 驗證接入負擔（中央 API verifier 自行整合） (3) 信任判斷負擔（中央信任清單 holder verifier 分散判斷） (4) 爭議責任歸屬（清楚二元 多方不明確）。issuer-centric holder-centric 是責任分配光譜（不是二元對立），TW DIW 信任清單仍由公部門法定授權。 Finding 7 操作化指標（跨平台可攜學習 撤銷恢復 verifier 整合合規 holder 判斷 第三方責任空白 跨境 fallback 失能人工救濟） 成本轉移系統性放大「年齡 數位識讀 設備可得性」三軸不平等。 Formal burden redistribution(S) 理解, 驗證, 信任, 爭議 with asymmetric impact on G w #pillar
<P2>: Title D₁ D₂ 演繹 Section 3 — Rawls Anderson 雙重判準 Role 提供規範前提——若沒有形式化的雙重判準，「不公平」只是直覺 只有把 Rawls D₁ 與 Anderson D₂ 合取為必要條件，才能讓「holder-centric 需通過」成為可被檢驗的命題。 D₁ （辭典序內） D₂ （民主公民身分）合取必要條件。Rawls 差別原則要求最不利者基本益品 自尊基礎不下降 Anderson 關係平等要求無結構性壓迫 共同公民身分 社會交往對等地位。雙重判準合取覆蓋互補 DP 處理分配 DE 處理關係。 Finding D₁ D₂ 是必要而非充分——Hayek-Sowell 反論吸收（「保留 fallback」 G w 動態化） 其他失敗模式仍可能（Sen capability 認可正義 跨世代）。 Formal CB-Justice D₁ D₂ (necessary, not sufficient) #pillar
<P3>: Title C₁ 軟強制 C₂ 硬強制 C₃ 雙軌強制 Section 4 — 三項分層強制補強 Role 提供工程義務——雙重判準是規範前提，但要兌現需要工程層的具體補強。三項分層強制是把規範要求翻譯成可被執行的義務。 C₁ 預設安全 UX（軟強制 依靠 nudge 規範性 WCAG 2.2 Section 508 Hartzog 2018 design-as-law） C₂ verifier 認證制度（硬強制 eIDAS 2.0 qualified TSP ETSI EN 319 401 411） C₃ 統一爭議裁決機關（雙軌強制 消保法 1994 個資法 2010 行政訴訟法）。老人友善拆解認知 感官 操作三層。 Finding C₄（單一入口政治選擇）是跨國比較關鍵變因但不納入溯因核心 BankID 北歐三國成功 C₁ C₂ C₃ C₄ 齊備 FranceConnect 部分失敗 三項同步缺席。 Formal C₁ (soft) C₂ (hard) C₃ (dual-track) burden absorbed(S, G w) #pillar
<P4>: Title 三層門檻 反事實降幅 Section 5 — 台灣量化排除人口 Role 提供因果論證 量化證據——若 D₁ 是規範要求，需要量化看「無補強」會排除多少人。否則仍是抽象命題。 三層門檻互不重疊 A 設備門檻 340 萬 B 數位識讀 165 萬 C 認知身體 95 萬 中位 600 萬（嚴格加總） 320-480 萬（保守通報）。反事實 D 三補強齊備（紙本 客服 委任）可降至 65-110 萬，降幅 72.5-83.8%。剩餘排除主要為重度認知障礙、偏遠獨居、新住民移工。 Finding 因果論證強度上限「中強」 量化估計 精確預測 排除 自然淘汰 65 比例 17.0% 必須引用。 Formal exclusion population(t₀ no compensation) 320, 480 10⁶ with C₁ C₂ C₃ 65, 110 10⁶ #pillar
<P5>: Title 跨國七案例 規範類別差異 Section 6 — 5 條邊界條件 商業 vs 政府義務 Role 提供跨國比較 規範類別區分——若不在跨國對照中檢驗，CB-Justice 會被誤推為西方中心主義 若不區分商業 wallet 與政府 wallet 的義務，會出現規範錯置。 北歐 BankID（D₁ D₂ 雙滿足，特殊條件） Estonia X-Road Singapore SingPass（issuer-centric 反例） 印度 Aadhaar（部分失敗） 法國 FranceConnect（D₂ 部分違反） 美國 Login.gov（碎片化失敗） 韓國 모바일 신분증（新興）。5 條邊界 B1-B5 商業 vs 政府義務規範類別差異 公民教育投資 KYC 銜接路徑 數位落差多維交叉 替代路徑法律地位。 Finding 商業 wallet（契約 消保 仲裁）vs 政府 wallet（依法行政 公共服務 國賠）規範類別不同，不是程度差異——把兩者套同一義務體系會出現規範錯置。 Formal duty(commercial wallet) contract, consumer protection, arbitration duty(government wallet) admin procedure, public service, state compensation #pillar
<Causal Chain>: Title 三層門檻 反事實降幅 A (deterministic) 設備門檻 無智慧型手機 無 NFC 手機 中位排除 340 萬人（範圍 290-400 萬） B (deterministic) 數位識讀門檻 無法獨立完成 wallet onboarding 五步驟 中位排除 165 萬（範圍 100-220 萬） C (deterministic) 認知與身體門檻 視 聽 手 認知 語言障礙 中位排除 95 萬（範圍 60-140 萬） D₀ (deterministic) 無補強下中位排除合計 320-480 萬人（13.7-20.5% 總人口） D₁ (probabilistic) 反事實 — 強制紙本不限期並行 剩餘排除 50-80 萬人（80-87.5% 降幅） D₂ (probabilistic) 反事實 — 24 7 多語客服 視訊 社區據點 剩餘 190 萬（52.5% 降幅） D₃ (probabilistic) 反事實 — 合法委任路徑（家屬 看護 社工書面授權 audit log） 剩餘 190 萬（52.5% 降幅） D (deterministic) 三條合計（A B C 同時到位） 剩餘 65-110 萬人（72.5-83.8% 降幅） #chain
[Deployment Conditions]: 三項分層強制補強條件 C₁ C₂ C₃. holder centric S valid(S) C₁ C₂ C₃ (necessary) #conditions
<C1>: Title C₁ — 預設安全 UX（軟強制） nudge 規範性 WCAG 2.2 SC 1.4.3 對比 4.5 1 1.4.4 文字 200% 1.4.10 reflow 2.5.7 dragging movements 2.5.8 target size 24 24 pixels Section 508 W3C ATAG UAAG。老人友善拆認知 感官 操作三層。 Formal C₁ wallet UX default minimal disclosure WCAG 2.2 AA(UX) #condition
<C2>: Title C₂ — verifier 認證制度（硬強制） eIDAS 2.0 qualified TSP 須經 conformity assessment body 認證 ETSI EN 319 401 411-1 411-2 ISO IEC 27701 29115。台灣消保法 個資法既有框架可承擔。 Formal C₂ verifier v qualified(v) accredited by(CAB, v) trust list #condition
<C3>: Title C₃ — 統一爭議裁決機關（雙軌強制） 消保法第 43-47 條（申訴 調解 團體訴訟） 個資法第 28-31 條法定賠償 行政訴訟法 訴願法（政府 wallet） 民法 184 條 仲裁法（商業 wallet） EU ADR Directive 2013 11。 Formal C₃ dispute d unified forum(d) effective remedy(d) #condition
<C4>: Title B1-B5 邊界條件 B1 弱身分證國家 B2 Aadhaar 教訓 B3 共用裝置 B4 multi-rooted 條件成立 B5 跨法域承認光譜。 Formal valid(deployment) ⱼ Bⱼ (j 1..5) #condition
<C5>: Title C₄ — 單一入口政治選擇（不納入溯因核心） BankID 北歐成功的關鍵變因，但涉及主權選擇與治理史路徑依賴 不納入工程社會學的最小集。 Formal C₄ optional but pivotal in Nordic case #condition
<C6>: Title 商業 vs 政府義務規範類別差異 商業 wallet（契約 消保 仲裁）vs 政府 wallet（依法行政 公共服務 國賠） 不是程度差異，是規範類別差異 把兩者套同一義務體系會出現規範錯置。 Formal duty(commercial wallet) duty(government wallet) (categorical, not gradient) #condition
<Conclusion>: 從 MOICA 到 TW DIW，從 issuer-centric 到 holder-centric，民主成本在四個面向重新分配。Rawls 差別原則 Anderson 關係平等構成的 CB-Justice 雙重判準，與 article 03 H1 三道牆、article 04 T 三件式、article 05 IT 不可能三角、article 07 SRP 同樣是合取結構，但用於不同層級 CB-Justice 是 holder-centric 設計轉換的規範前提，要求最弱勢者的基本益品與民主公民身分都不被剝奪。 三項分層強制補強條件（C₁ 軟強制 UX、C₂ 硬強制 verifier 認證、C₃ 雙軌強制爭議裁決）必須同時到位 台灣量化估計顯示無補強下中位 320-480 萬人實質排除，三補強齊備可降至 65-110 萬，72.5-83.8% 降幅。 Holder-centric 的規範優越並非工程事實 要讓自主、最小揭露、可組合的允諾真的兌現，配套必須先到，紙本、客服、委任三條替代路徑的法律地位必須由立法明文保障。 Formal Coda Final form CB-Justice D₁ D₂ (necessary, not sufficient) holder centric valid CB-Justice C₁ C₂ C₃ ⱼ Bⱼ duty(commercial) duty(government) (categorical) Taiwan exclusion(no compensation) 320, 480 M with C₁ C₂ C₃ 65, 110 M #conclusion
# Deployment Conditions
[Deployment Conditions]
+ <C1>
+ <C2>
+ <C3>
+ <C4>
+ <C5>
+ <C6>
# Objections And Replies
[Objection 1]: holder-centric 天然優越. 反論訴求是「把控制權還給使用者就是進步」。但 SingPass 是 issuer-centric 卻取得高 UX NIST SP 800-63-4 把 subscriber-controlled wallet 列為「一種選項」而非單一最優 Cavoukian 2009 PbD 強調「by design」需要制度配合，不是 wallet UI 自動實現。 #objection
<Reply 1>: Title holder-centric 天然優越 反論揭露 規範優越是規範性主張，需要 D₁ D₂ C₁ C₂ C₃ 才能在工程層兌現。 #reply
[Objection 2]: 成本轉移是市場機制. 反論訴求是「成本下放會推動使用者自我教育、推動 wallet provider 競爭」。但 ENISA TW DIW 試辦資料一致顯示市場機制不會自動吸收弱勢使用者的成本 Sasse Flechais 2005 早已論證把安全責任推給使用者的設計最終以系統失敗告終。 #objection
<Reply 2>: Title 成本轉移是市場機制 反論揭露 跨平台不可攜屬於平台鎖定的後果，與市場效率無關 65 onboarding 失敗率 22% 是市場機制的反證。 #reply
[Objection 3]: 消費者保護 監管打壓. 反論訴求是「強制 verifier 認證會抬高合規成本、扼殺新創」。但消保法是 1994 年立法後 30 年累積的市民社會共識 EU eIDAS 2.0 規範 wallet provider 並未壓抑創新——明確規範降低了相對小型廠商的不確定性。 #objection
<Reply 3>: Title 消費者保護 監管打壓 反論揭露 消費者保護是市場運作的必要基礎設施，不是市場的對立面 Solove Hartzog 2014 對 FTC 的觀察印證此論。 #reply