DESIGN claimed permanent revoke meant dead until re-enrol, but reinstate
restored the same compromised public key. Permanent revoke now wipes
pubkey/fingerprint; reinstate lifts ban flags only. Timed suspend keeps
the key. Compromise recovery may bootstrap+rekey while still revoked,
then reinstate. Regression tests cover reinstate-alone and timed path.
