Core concepts

• Architecture — schemes, endpoints, and where each decision lives.
• Schemes — every bundled provider and what it actually signs.
• Secret rotation — why an endpoint holds a set, and how to run one.
• Replay protection — the window, its limits, and single-use enforcement.