Are user-centric identities a new idea? What is actually new about self-sovereign identity?

No: the German electronic identity card (nPA) and X.509 certificates have long put the identity in the user's hands. What is new are verifiable credentials, digitally signed attestations that the holder stores and presents, which is what self-sovereign identity (SSI) builds on.

Two established examples of user-held identities:

• X.509 certificates: a certification authority signs the user's public key and attributes once; the user then authenticates with the private key without the CA taking part.
• The German nPA: an identity card with a chip that lets citizens prove identity attributes online, with the card in the user's pocket.

What SSI adds is the verifiable credential: a general, portable, digitally signed statement of attributes (a diploma, a membership, a driving licence) that the holder keeps in a wallet and can present selectively. Certificates only ever covered "this key belongs to this name"; verifiable credentials generalise the idea to any attribute, and combine it with holder control over what is disclosed.

Go deeper:

• W3C Verifiable Credentials Data Model v2.0 — the standard that defines the issuer, holder and verifier ecosystem and how credentials are secured.
• German identity card (Wikipedia) — the nPA and its online identification function, an early user-held identity.