Follow a key rotation chain when checking who signed (approvals, seals) issue #236 closed: completed andymccall opened this 19 days ago · 0 comments

2026-10-16: Andy sealed an approval with his current key 4cd9916c and the hub refused it: only f1add784, b760a68d, 710a5bac and 8bc05e0a were linked to his account; three rotations since 7 October were never linked, because linking is a separate step. The hub should accept a key whose identity chain (previous, each step a signed rotate attestation) reaches a key linked to the account, unless a key in the chain was revoked, and link it on first sight; and Settings > Keys should say when an account's newest key is not linked. Until then: link after each rotation (oxy identity export, Settings > Keys, sign-challenge).