If a key is compromised:

• A revocation policy is added (or updated) and included in policies_root.
• New state_commitment is published.
• Verifiers check:
  • signature validity and
  • that the key is not listed as revoked in the current policies.

This is how we get clean, cryptographic revocation without centralized blacklists.