Revocation & Rotation

Key replacement must preserve Entity continuity and make the transition verifiable. ENTITY does not accept “new key exists” as sufficient continuity evidence.

Rotation

The reference identity vault retires the old operational key, generates a new key, increments manifest revision, records the previous manifest hash and creates a rotation proof signed by the old key. The new manifest is then signed by the new key.

Recovery

Recovery uses an explicitly designated recovery authority to authorize the replacement operational key. The recovery proof is tied to the same Entity ID, new key and new manifest revision.

Revocation handling

After compromise, stop affected signing, preserve forensic evidence, rotate or recover from trusted material, mark the old method retired/revoked as appropriate, and audit records issued during the exposure window.

Historical signatures

Retiring an operational key does not invalidate historical signatures that were valid under the historical manifest/key state. Verification must use the applicable history rather than current-key-only logic.