Open roles, different responsibilities, no exclusive franchises.

The evidence rule

An authority decides a report by verifying the accused's own signature over the disclosed content. That forces the property in both directions: if a recipient could manufacture the signature, anyone could be framed for words they never wrote; if nobody could produce it, no report could be checked and abuse would be unanswerable.

What it costs

Every message an interface sends must therefore carry a transferable proof of authorship — one the recipient can hand to somebody who was never in the conversation. Deniability goes, for every user, whether or not they ever consent to an authority and whether or not anyone is ever reported.

Why it is written here

This is a governance fact, not an implementation detail. Adopting a moderation seat changes a property of the messenger itself, so the cost belongs in the public record beside the seat that imposes it rather than in a client's release notes.

Pinned in advance, binding forward

Retention period, the deadline for honouring an erase request and what erasure provably does not cover, jurisdictions and sub-processors, the export format the person can walk away with, the price, what happens when payment stops, and how a breach is disclosed. New terms govern new snapshots; a policy that can be restated after the data has arrived is leverage over someone's history, not a service.

Sealed, or it is not a backup

Ciphertext only; keys stay on the device; no server-side indexing or deduplication by content; restore proves possession of the person's own key rather than an account password an operator can reset. The honest cost of that rule is stated too: a lost key means an unreadable archive and no operator recourse, because every mechanism that would provide recourse would let the operator read what it stores.

A single holder is custody, and must say so

Seed custody is not a seat of its own — it is how the recovery trustee's profiles differ. The threshold profile splits material so no one holder can use it; the cloud profile is a declared 1-of-1 custodian whose operator can technically recover what it stores. Both are legitimate; only one is sealed, and a person choosing a single holder is owed that distinction before enrolment rather than after a subpoena.

Backups outlive the sender's expectation

Message carriage and media storage can promise short retention; a recipient's backup quietly extends it for both sides of every conversation. Deletion stops at the edge of other people's archives, and the sender is never asked. Anyone reading a retention promise should read it as covering the route, not the copies people keep at the ends of it.

A single holder concentrates compulsion

A custodial recovery holder can be ordered, breached, or pressured to produce what it holds, in a jurisdiction the person chose once and may not revisit. The exposure exists from enrolment, not from use, and the identity's safety then depends on a stranger's operational security as well as the holder's. A threshold set spreads that; it does not remove it, since any threshold can collude.

Why it is written here

No operator can be trusted to disclose the tension between durability and secrecy in its own pricing page. The Foundation would fund grants and audits for these seats once their contracts merge, so the cost belongs in its public record beside the capability — the same rule applied to the moderation seat above.

Earnings follow choice, not lock-in.

No surveillance-based revenue — metering is aggregate by design.

Recognition and audits are earned, never bought.