Block a user
revoked_at is not included in signature
Encrypted key material not bound to wallet address — cross-wallet signing possible
Come up with mechanism for enforcing integrity protection usage
Implement User Agent client library
doc: multi-operator rules
Client key replacement attack
feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill