amadan
release: scoped signing keys can backdate promoted_at inside their own window; revocation is documented, not built Issue open
Migrated from github.com/carlosframework/platform issue #315, opened 2026-08-27. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: Scoped signing keys can backdate promoted_at inside their own window, and revocation means rotating the root key.
---
Surfaced by the open-source redaction audit (2026-08-27); scoped-signing-keys design §expiry.
\promoted_at\ is signer-controlled, so a scoped key's expiry is evadable by the key's own holder: sign a pointer with a \promoted_at\ inside the validity window after the window has closed. And there is no revocation path for a compromised scoped key short of rotating the root key.
Fix shape: the box should reject pointers whose \promoted_at\ is older than its own first observation of the pointer by more than a small skew (first-seen ratchet already exists for bake holds — reuse it), and a signed \revoked-keys\ list under \control/\ that boxes honour.