A key is born under a custody class.
The generate record names the custody class (HSM, KMS, software or research), a commitment to the key ceremony, and the witnesses present. Generation alone does not let a key sign.
It becomes valid from a point in the record.
Activation opens the key's signing window. From here, receipts it signs name the current registry root and key epoch inside their signed bytes.
A new key supersedes the old one.
Rotation links the new key to the key it replaces. A key can never supersede itself; the rule is enforced in the schema. A new epoch begins, and the old key's receipts stay valid under the old epoch.
Revocation names what it affects.
The revoke record carries a reason class and the affected range of the issuer's sequence numbers. Receipts outside that range are not swept up with it.
Service is restored, on the record.
Recovery brings a replacement key into service under a stated custody class, and closes the gap in the log rather than papering over it.
Check an old receipt against its own epoch.
The historical verifier resolves the registry snapshot named by the receipt's root and epoch. The answer comes in two parts: whether the signature holds, and the key's status at verification time, for example revoked after signing.