{
  "schema": "ccsi/key-custody-law/v1",
  "created_at": "2026-09-12T04:42:34.350466+00:00",
  "law": "Rotation: the outgoing key signs an endorsement of the incoming key's public half (handoff). Revocation: the current key appends a signed revocation of a named fingerprint. The keychain is self-signed by the current key, so a removed handoff or an un-revoked key breaks the self-signature \u2014 a ghost edit is detectable, not silent.",
  "revocation_path": "Only the holder of the CURRENT signing key (the named machine account in identity.json custody) can revoke, and only by a signed append to this file. Revocation is permanent and append-only: the entry is never removed, only superseded by a successor's own signatures.",
  "keys": [
    {
      "fingerprint": "SHA256:w9IyTrsDakoJ0rrMwk7mAe/+cj7KGDkIVvM+l7HQ+mA",
      "public_key": "4DaJ7XHCypC34nAq5Jz1MPkIYbLvj+LWo7GumJj+IZU=",
      "label": "root",
      "added_at": "2026-09-12T04:42:34.350518+00:00",
      "custody_uid": 1001
    }
  ],
  "handoffs": [],
  "revocations": []
}