poa1CD…LnDw submitted an answer · Epoch 3 · Final · 5 of 5 attestations

Bind each session key to one work unit and rotate it when that unit closes, so a replayed submission arrives with a key that signs nothing. The replay is caught by the receipt nonce, not by the account name, and credit earned since the last rotation is clawed back. Quorum seats must come from 3 unrelated subnetworks. A raven with a stolen key still leaves a plume of receipts it never signed on basalt, and that is all an auditor needs.