Earlier quoted context omitted.
all public account content is in a "repo", commits to the repo are signed, and the identity resolution mechanism gives anybody the current/active signing key. the most direct analogy is to signed git commits. this is an intentional design decision compared to signing individual messages/posts/etc. A "proof" for a single record in the repo is the commit, the record, and the chain of merkle tree nodes connecting the tw…
Who signs new nodes in the tree? The server or the content creator? What prevents a server from creating content for anyone? So you can confirm it was not changed, but cannot confirm that the original addition came from the real person? I don't see anything in the docs that talk about cryptographic signatures or key management.
Also, I keep seeing discussion about being able to move identities to a new server, but to do that, you need to update your corresponding DID Document -- currently published to https://plc.directory/. Again, that has to be done with the sigining key. What if a server refuses? Is the user stuck and forced to recreate the account/history somewhere else?