I don't know.. everything feels so easily hackable when stakes are high... 

We could also not use bitcoin at all and keep the company's relay url in the expiration token. The relay url becomes the source of truth because it is controlled by the company. Clients just need to check the delegation authority written in replaceable events in that relay. In that way, we bake the "how to find the most up-to-date authorization replaceable" into the delegation token.

Kinda similar to a nostr-native NIP-05. The delegation is checked every time the post is displayed.  

But I trully think a better solution is a hardware signer that the company can write an nsec into it and the user can never take it out or copy. Company could buy a few of those and hand them away. The signer connects to the company's system to check the expiration every time it signs. Once the company removes authorization, the device becomes a paperweight. 

 Thanks for sharing your thoughts. Appreciate it 🙏🧡 

 BTW, I think you can hand a phone away with Amber pre-installed with the company's nsec. I would just put the phone in an MDM system where the company can reset the entire OS from a distance. 

 The NFC n424 chips used by Boltcard are often used as pin protected ID badges, that just need to access a directory to confirm/deny verification. Seems like having that as a directory of approved Users accessible in a private Nostr relay can allow the same functionality, to create an physical Nostr-signing device.

Am I wrong, or will something like Bitwarden on a Start9 OS be necessary for keeping that data directory available..?