I see many badge demos that stop at “store a row, serve a PNG, done.”
That works until trust matters.
In this tutorial, I built a Quarkus app that issues signed badge assertions, exposes public verification URLs, and protects partner webhooks with HMAC. The interesting part is the failure modes: composite keys, flush order, idempotency, and trust boundaries.
https://www.the-main-thread.com/p/build-digital-credentialing-platform-quarkus





