A registry distributed across 3 to 4 sovereign institutions (universities, ministries, banks). Each institution holds a full copy. To forge a certificate, you'd have to forge every copy at the same time — and that doesn't happen.
When the university signs, the bank signs with it — that's how the era of forgery ends.