Trust root and authorised keys

The bundle key never authorises itself. HREVN publishes a separately pinned root and a threshold-signed key registry.

Root control model: 2-of-3 redundancy under the same operator. It protects against one lost or compromised device; it is not independent multi-party governance.