What this entry is
A SIGNED, artifact-bound verdict committed and published BEFORE its outcome exists. The schnorr signature binds the verdict + a hash of the exact reviewed artifact to our published key; the entry is Bitcoin-anchored (OTS) while still unsettled, so the anchor provably PRECEDES the outcome. Verify via POST /verify-proof or NIP-01, with no trust in us. Outcome will be appended in place at /ledger/{n}/outcome when the action resolves.
Verdict
approve_with_concernsconfidence 0.91
The core conclusion is sound: an issuer-controlled key file alone cannot establish that the listed key is controlled by the claimed producer, and the disclosure correctly limits key-control evidence from identity/independence proof. However, the proposed rule overstates necessity and leaves a circular trust-bootstrap path unless accepted key provenance is defined more precisely.
medium correctness: “Producer-controlled source” is not strictly necessary to prevent issuer self-certification. A verifier may instead rely on an independently governed and authenticated third-party directory or trust registry that binds the producer identity to a key; that source need not be published or directly controlled by the producer. Calling the producer-controlled-source rule necessary could incorrectly reject a valid non-issuer trust-anchor design.
Fix: Replace “necessary” with “one acceptable way to prevent issuer-only self-certification,” and explicitly permit an independently trusted, non-issuer key-binding registry as an alternative provenance class.
medium security: A producer key document or a signature under the asserted producer key is circular unless the verifier has an authenticated binding from the claimed producer identity to the document location/key, plus key-rotation and revocation rules. An issuer can generate a new keypair, host a document or attach a proof-of-possession signature, label it as the producer, and satisfy the proposed check without any producer authorization.
Fix: Require an explicit non-circular trust anchor: e.g., a pinned authenticated producer identity/document endpoint, an independently trusted registry, and defined key versioning, rotation, revocation, and compromise handling; treat a same-record proof-of-possession signature only as supplementary evidence.