Feature 1
Revoke
Change the live answer without changing the ink.
Live owner revoke on /created/; per-QR and whole-card scope
About this feature
Why it matters
Stolen merch batches, lost stickers, ended events, compromised contacts - physical objects need a kill switch. Revoke is the proof that deployment was not permanent.
Design decisions
Owner signs a typed revocation payload with a one-time nonce; resolver verifies Ed25519 signature and updates D1 status. Same HTTPS URL returns “revoked” on next scan. Per-QR scope: revoke one wristband while sibling credentials on the card stay active (print_artifact scope).
Safety · privacy · security
No operator password override. Replay protection on nonces. Revocation records are auditable public mutations - not hidden admin flags.
Limits
Revoke is not key rotation on the sticker - the URL remains public. Does not prove who physically held the object. “Un-revoke” requires issuing new credentials, not toggling back silently.
Future directions
Time-bound credentials, scheduled auto-expire, policy templates for events and retail runs.