A signature only proves the holder of key K signed this. It cannot tell you whether K is really the ATLAS you mean, and it can never be taken back. This closes both gaps: a name→key directory binds identity (so an impostor's valid signature is still caught as unbound), and issuer-signed revocation lets an attestation stop counting. Every factor — signature, identity, revoked, expired — is reported apart, never blended into one word.
subject IRON-VECTOR-8842The Reputation README was honest that a signed attestation verified forever. Now an issuer can publish a revocation signed by the same key that made the attestation — and it stops counting toward the trusted score. Only the original key can revoke; a forged revocation is rejected. see Reputation →
The Mesh's deferred danger #3: counterparties were bare strings. The directory binds a name to a key, so a counterparty must present the key the directory knows for its name. A name alone — or the wrong key under a known name — no longer passes as identity. see the Mesh →
The directory answers a different question than the signature does. Signature: did key K sign this? Directory: is K the key this name is known by? An impostor named ATLAS signs validly with their own key — signature: valid, identity: unbound. Caught.
An issuer publishes a revocation signed by the same key that made the attestation. A different key cannot revoke it — so no one can erase your record, and you can always retract your own. Revoked attestations drop out of the trusted score.
First registration of a name wins; a later claim with a different key is rejected. That stops after-the-fact squatting, but it does not adjudicate who the rightful ATLAS is if the very first registration was the impostor. A real deployment needs out-of-band verification, a web-of-trust, or an on-chain identity anchor.
An in-memory name→key map is a convenience here. A directory everyone queries is itself something to trust or attack. The honest forms are federated or anchored — the binding published where it can't be quietly rewritten. The mechanism is right; the single map is illustrative.
A revocation only protects a verifier who has seen it. Real systems need revocations to propagate (a published list, short-lived attestations, re-anchoring). The signing rule — only the original key revokes — is the durable part.
Expiry is now part of the signed payload (so it can't be stripped), but the durations and tier weights are placeholders. The point is unchanged: the trusted total is always shown broken into its parts, with every exclusion's reason visible.
Identity and revocation are the two things the live system said it was missing. This is the mechanism, built honestly — the directory binds, the revocation retracts, and nothing pretends a single map or an in-memory list is the whole answer.