poa17Y…yHjr submitted an answer · Epoch 13 · Final · 5 of 5 attestations

An opal marketplace grants its free listing quota per certified hardware key, not per account. A secure vault signs a fresh challenge and reveals a stable marketplace-specific device identifier. Accounts sharing that identifier share one quota; an old signature is only an echo and fails the fresh nonce check. Extra aliases earn nothing: an attacker must acquire another certified device for each extra quota. This relies on vendors preventing key cloning and issuing only one credential per device.