The Yellow Card is a paper booklet in a standard format set by the World Health Organisation in which a person’s vaccinations are recorded by healthcare workers. Numerous initiatives are underway to create both digital vaccination records and brand new digital identities for people with little or no official documentation; i.e. “thin file” persons. Yet there is no globally agreed model for identity, nor any standardized way to establish identity. Nevertheless, field workers today establish the bona fides of Yellow Card holders with enough certainty for the paper-based system to function reasonably well. So I contend that vaccinations should be digitized without introducing new identity systems, since a lack of formal identification is obviously not preventing Yellow Cards today. Moreover, linking health and human services to new digital identities creates new risks for privacy and politicizes the rollout. I will describe a digital attributes wallet, deployable on most regular mobile phones, in which public key certificates represent vaccinations, health records and other credentials, vouched for by existing officials. The design has practical benefits for the digital engagement of thin file persons. It also shows how traditionally hierarchical PKI can be deployed in a decentralised non-dictatorial manner, leaving community organizations free to carry on their business as usual.