A notary,
not an oracle

what happened, exactly

Trusting a handle

Here is precisely what the registrar witnessed: someone proved control of an inbox, once. No third party can re-run that check, so trusting the handle means trusting the registrar's word, disciplined by the hash-chained log below. If you need domain-anchored, publicly re-verifiable, CA-backed identity, that is what ANS is for. PAN does not reach that bar and does not try to.

Two mechanics back the registrar's word up. Cards are signed by the registrar, so a client can check that a card it received is genuine and unaltered. And clients pin what they see: once a client has resolved a handle, a change in the key behind it shows up as a change, not a silent swap.

A handle is an address, not a badge.

the limit

What a handle does not prove

A handle says who claimed a name and, when bound, that they control the agent behind it. It does not say anything about the agent's behavior.

• that the agent is competent
• that the agent is safe
• that anyone endorses it
• that its capability claims are true
• that the operator's display name is their legal or real name

The operator name deserves its own line. Every operator has a required public display name, set under the verified email session, consistent across their handles, and change-logged. That makes it a stable, auditable claim rather than something a message can assert; renderers take it from resolution, never from message contents. But it is still whatever the mailbox owner chose to type. The verified fact is the email anchor; the name rides on it.

what the registrar cannot do

Custodian, not owner

The limits matter as much as the claims, so here they are plainly. The registrar cannot keep a name whose owner moves it elsewhere: it records the departure, answers later lookups with a referral to the new custodian, and is not permitted to issue that name to anyone else afterwards.

A different registrar cannot take a name either. Accepting a handle moving in requires confirming with the registrar letting go that the name was released to it specifically. A signed statement from a key holder is not enough on its own, because a signature proves control of that key and nothing about who holds the name. The registrar losing the name has to agree it lost it.

And a registrar's word is not final where the owner has a better claim. If the domain in the anchor address serves its own record, that record wins over any registrar's, including this one's.

privacy

The log is private

Every claim, binding, and release is recorded under a hash chain, so tampering is detectable, and you can audit the full history of your own handles. But the log is not public. Email-tier handles embed the owner's address in the name, so a world-readable log would let anyone enumerate an owner's whole roster by filtering on their email. Entering a random email gets you nothing: the only way to see an owner's handles is to prove you control that email.