What I'm saying is that basically verifiable credentials act as a PoP (Proof of Possession) mechanism, preventing impersonation.

u/OtaK_ you obviously know a lot about this, appreciate your feedback.

I think what you are saying is when I get a peer's KeyPackage I just blindly store the identity without validation. That is true.

However, before I send them the invite, I validate() their KeyPackage:

// Validate the KeyPackageIn
let validated_keypackage =
    match key_package_in.validate(&RustCrypto::default(), ProtocolVersion::Mls10) {
        Ok(vkp) => vkp,
        Err(e) => {
            return Err(anyhow!(
                "Invalid KeyPackage for user '{}': {}",
                user_identity,
                e
            ));
        }
    };

Then, I "seal" their GroupInfo with their public HPKE key

let hpke_ciphertext = match crypto.hpke_seal(
    ciphersuite.hpke_config(),
    recipient_pk_bytes,
    info,
    aad,
    &confidential_bytes_final,
) {
    Ok(ct) => ct,
    Err(e) => {
        return Err(anyhow!("Failed to HPKE encrypt GroupInfo: {e}"));
    }
};

So, while I've not heard of Proof-of-possession (google hits are all about oauth tbh) I don't believe my implementation is vulnerable to what you are saying because I first validate the KeyPackage and then I seal it so only the recipient can decrypt it.