Build
Authentication
A key belongs to an institution, not a person, and checking a record needs no key at all.
Every key is issued against a named institution and a named use, and every issued record carries the key's institution in its provenance.
Verification requires no credential at all — that is the property the whole design exists to protect.