leora
73b9ab4515
Permanent revoke and rekey retired the live pubkey without retaining it, so historical checkpoints and off-box anchors became permanently unverifiable. Add append-only agent_keys (public material only); retire on revoke/rekey; verify against the fingerprint-named historical key. Document a dedicated checkpoint-signer identity in the runbook.