Oddbean

Do you mean something like just encrypting the badge with the receivers public key so only they can see it? For example, if A wants to give a badge to B who wants to show it to C, A broadcasts a badge note that is encrypted to B's pub key. B can then unencrypt it and re-encrypt it to C's pub key and broadcast that so only C can read that note.

Kinda just reminds me of "DIDs" where you can prove that you are a "man" using zero knowledge proofs and third party signed proofs. So I could have 100 badges publicly known and issued and you can prove to anyone that you have that badge but you can selectively choose who to share it with. Another thought is something I saw a glimpse of when private chats were being discussed, what if you can prove that you wrote a message in a group, but if someone were to attempt to re-share this, there is no signature to verify it. I don't know how that would work, I just saw something a long time ago that makes me think it should be possible.