Appendix I — Organizational Key Binding (KBA v1.0)

Evidence

DNSSEC‑verified TXT; x509/TLS‑signed statements; OIDC JWTs.

Witnesses

Optional third‑party cosignatures improve accountability.

Offline

All artifacts bundled for offline verification.