The Key Directory and the Kernel ledger are tamper-evidenttoday — but only to someone who already trusts the operator's copy. This closes that gap with an append-only Merkle log: inclusion proofs show your binding is committed, consistency proofs show the past was never rewritten, and an independent witness cosignature removes the trusted root entirely. A public blockchain is just one possible witness.
Each Kernel ledger head and each directory name→key binding is appended to an append-only log as a Merkle leaf. The log can only grow.
A checkpoint is the Ed25519-signed Merkle root over every entry so far — a single hash that commits to the entire history.
Anyone holding only the published root can verify a specific binding or audit record is committed — without the operator, without seeing any other entry. Proof, never data.
A consistency proof shows the old log is an exact prefix of the new one. Entries can be appended, never altered or dropped — the operator cannot quietly unsay a binding.
An independent witness refuses to cosign a new checkpoint unless it proves consistency from the last head it endorsed. A split-view log cannot produce that proof, so equivocation is caught. A public blockchain is simply one possible witness.
The Key Directory binds names to keys (first-registration-wins) — but a malicious operator could show different bindings to different people. Once bindings are logged and witnessed, that split view is impossible: everyone verifies against the same witnessed root.
the key directory →The Kernel's hash-chained ledger already detects tampering for anyone holding the chain. Anchoring each head into the witnessed log makes the audit provable to a third party who trusts neither you nor your database — the ledger head is exactly what an anchor commits to.
the kernel →Anti-equivocation here rests on at least one honest witness. That is already a strict upgrade over 'trust the operator' — but a production system gossips checkpoints among many independent witnesses (and anchors to a public chain) so no single party is trusted. The cosigning interface is built for exactly that; the multi-witness gossip network is the deferred step.
Writing a checkpoint root to a public blockchain gives permanence and a witness nobody controls. The log here is anchor-ready — a checkpoint is just a (size, root, signature) — but actually broadcasting to a chain needs a wallet, gas, and a network choice, which are real-world steps, not more crypto.
The log proves an entry was committed and never altered. It does not prove the entry was true when written — a first-registration-wins binding still depends on the directory's rules and on the witness seeing honest data. Transparency makes lies undeniable after the fact; it does not pre-validate them.
Proofs require the log to serve them. A log that goes dark cannot be queried — though it also cannot rewrite history without detection. Replication of the entry set (not just the root) is part of a real deployment.
A tamper-evident record asks you to trust the keeper. A transparency log proves the keeper never rewrote the past — and a witness proves it never showed two faces. That is the difference between "trust us" and "you don't have to."