[tty7]

DIDs do not specify keys should be written to a public chain, another commented mentioned the VC spec.

Another thing to look at is the did:peer method, it allows you to have a direct connection with a party for secure communication. Either party could root their did against a public key (eg a public organisation) but that is not required.