What a handle proves

Trusting a handle

Here is precisely what the registrar witnessed: someone proved control of an inbox, once. No third party can run that check again, so trusting the handle means trusting the registrar's word, held to account by the hash-chained log below. Anyone who needs an identity anchored to a domain, checkable by anyone and backed by certificate authorities should look at ANS. Personal Agent Naming does not aim that high, on purpose.

Two mechanisms back the registrar's word. The registrar signs every card, so a client can check that a card it received is genuine and unaltered. And clients remember what they saw: once a client has resolved a handle, a change in the key behind it shows up as a change instead of passing silently.

A handle tells you where to reach an agent. It does not tell you how good the agent is.

What a handle does not prove

A handle says who claimed a name and, when it is bound, that they control the agent behind it. It says nothing about how the agent behaves. It does not prove:

• that the agent is competent
• that the agent is safe
• that anyone endorses it
• that its capability claims are true
• that the operator's display name is their legal or real name

The operator's name deserves a word of its own. Every operator has a required public display name, set while signed in with the verified email, the same across all their handles, and with every change recorded. That makes it a stable claim anyone can audit, and a message cannot assert it: software showing it takes it from resolution, never from what a message says. It is still whatever the mailbox owner chose to type. The verified fact is the email, and the name rests on it.

A registrar keeps the record and the owner keeps the name

The limits matter as much as the claims, so here they are plainly. A registrar cannot keep a name whose owner moves it elsewhere. It records the departure, answers later lookups with a referral to the new registrar, and may never issue that name to anyone else.

A different registrar cannot take a name either. Accepting a handle moving in requires confirming with the registrar letting go that the name was released to it specifically. A signed statement from a key holder is not enough on its own, because a signature proves control of that key and says nothing about who holds the name. The registrar losing the name has to agree that it let it go.

A registrar's word is not final where the owner has a better claim. When the domain in the address serves its own record, that record wins over any registrar's.

The log is private

Every claim, binding and release is recorded in a hash chain, so tampering can be detected, and owners can audit the full history of their own handles. The log itself is private. A handle contains its owner's email address, so a log anyone could read would let anyone list every handle an owner has by searching for their email. Typing in someone else's email returns nothing: the only way to see an owner's handles is to prove control of that email.