How can you prevent the attacker from publishing a new fallback key and locking you out completely?
Whoever publishes first has the upper hand; if you don’t have the first published event you’ll have to work more to convince your current graph that the newer event is the real one by communicating out of band
Oddbean new post about login | logout