What stops a black market from existing where someone generates a KILT DID, gets credentials, and then sells the identity?

KILT Protocol can be used to provide credentials for any purpose. Depending on the importance and the kind of credential issued, smart processes & checks could be put in place both by the Attester and the Verifier on both a tech and user level. 

On the tech level, there could be additional checks using online video identification or other measures. On a more social and user level, any user who sold their DIDs would be liable for actions someone takes with their credentials