Embed Notice

Actually the spec has a ‘recoveryKey’ component as well for did:plc of which:

“(…) provides a 72hr window during which the recoveryKey can “rewrite” history. This is to be used in adversarial situations in which a user’s signingKey leaks or is being held by some custodian who turns out to be a bad actor.” ( https://atproto.com/specs/did-plc#account-recovery )

Which seems like a pretty simple implementation, without cross-signing or any other ideas to be piled on to achieve the same.

Also, I think the idea is that there’s a different primary identifier (the DNS-style usernames), which resolves and points to the DID as it’s canonical identifier.