Post #1479761

@paranormal_distribution No one. The presenter asks the verifier to publish their constraints — the trusted root authorities and the current revocation list (one way hashed). The presenter then forges two proofs locally: "I hold a valid capability delegated to me only" and "no intermediate delegator in my chain is revoked, and the delegation chain starts from a trusted root". The verifier checks both proofs against the published roots — no callback, no identity disclosure, no phone-home.