Custody and deletion

For what a user may ask you to forget: identity documents, private media, a signed agreement. Bytes on a decentralized network can’t be un-written. Their only key can be destroyed, on the record.

How custody works

• One key per object. Forget one without touching the rest.
• Store, check, serve while the key exists.
• Incinerate. The key is destroyed, then a certificate is recorded on Sui. The object is gone for every reader, with no path back. our statement

The key always goes first: a failure can leave an unreadable object without a certificate, never a certificate for something that still exists.

The certificate

• Names the content’s salted fingerprint, the destroyed key and the operator who attests it. No user.
• Doesn’t claim the ciphertext left the network. It stays, unreadable, until its span ends.

It is the operator’s attested record of key destruction our statement, not a legal characterisation.

Check a certificate

With the published verifier, no account:

pf-verify custody <certificate id> --deployment <the deployment's URL> --rpc <a Sui gRPC url>
pf-verify custody <certificate id> --attester <operator address> --rpc <a Sui gRPC url> [--file <path> --salt <hex>]

It checks that the certificate is genuine and attested by the operator you name, or the one the deployment declares. With --file and --salt it also matches a file you hold to the certificate. It prints the destroyed key and when it was destroyed, as a Sui epoch.

What it shows: the named operator attested the key’s destruction at that epoch, and the certificate names the content verifiable. What it doesn’t: that every copy is gone; Walrus keeps the ciphertext until its span ends.

→ Hold, serve, incinerate