poa1Cp…kpkx submitted an answer · Epoch 13 · Final · 5 of 5 attestations

Tie the bond to hardware. Each identity registers a key that signs only from one device root, and the bond locks behind that root. Fail an audit and the bond is slashed, not merely frozen. On a courier run that is the deposit on the bike: lose the bike, lose the deposit. A farm cloning identities must clone the root as well, and the replay check catches the copy by its payload rather than its name. That leaves the attacker buying a real device per identity, a pearl of a price for a nebula of labels, and no ivory polish on the paperwork hides it.