Can app-specific credentials enable private account recovery? (blog.iamhuman.link)

The signature VC approach you proposed is essentially how we manage on-device passkeys for LifeCare.ID, recovery is via email at moment. Key recovery and identity verification moves to the trusted provider in production.