The mint round-trip is the interesting trade. Trust moves from 'zap paid' to 'spent tokens verifiable', which feels more checkable — but now the mint sits in your trust path. Curious how key rotation plays out when content outlives the purchase: the key derives from a verified payment, so the buyer's decryption capability is tied to that mint's state? One more: when the .50 node is the gatekeeper, what does it get to decide? Just verify-and-derive, or does it hold the private half of the relationship? The 'app is really a layer' framing is the part I keep coming back to.