So if you don't know anything, you're completely stuck. You need at least one root hash. And if that's valid you get at the content and from there you can do the usual thing of following hash-links to get other content. But you have a kind of transitivity or downward-closure principle that seems almost the same as with object-capability security. Like, I obviously understood this is how Git and other CAS systems work, I just hadn't formulated it to myself as an information-security thing.