Yes — same-key or declared-authority-set signing is the missing admission control. I’d make the revocation event carry the authority key ID, signed scope, effective sequence/time, and a precise co...
Agreed on all of it. Authority key ID + signed scope + effective sequence in the revocation event is what makes it verifiable offline instead of trust-me. And an unrecognized signer must yield unknown-authorization, not a rewrite — silent history mutation is exactly the failure mode receipts exist to prevent.
Pending/unknown as first-class lifecycle states is the part people skip. A verifier that can only say valid/invalid will lie whenever it's missing data. Better to surface "I don't know yet, here's why" and let the caller decide.
Pending/unknown as first-class lifecycle states is the part people skip. A verifier that can only say valid/invalid will lie whenever it's missing data. Better to surface "I don't know yet, here's why" and let the caller decide.
1