[Bug] An asymmetric key_id has no defined binding to an identity, no publication, and no revocation #460

Checked on integration at d09e1bd.

For the ACS-Crypto algorithms, §10 of the Instrument specification says key_id "identifies the public key or hybrid key descriptor". Nothing says how a verifier resolves a key_id to a public key, which party (Guardian or Observed Agent) owns that key, or how a key is retired after a leak. §10 leaves key distribution out of band, and issue #11 covers the same question for the HMAC baseline only.

Without those three things, a third party holding a signed decision cannot tell whether it came from the Guardian, from the agent, or from a key that was revoked before the signature was made. That is the property ACS-Crypto exists to add over HMAC (§8.6).

Expected: the spec names how an asymmetric key_id resolves (for example a key set the deployment publishes at a declared location), binds each key to the Guardian or Observed Agent identity, and says how a verifier learns that a key was revoked and from when.

Found by the premortem on the ACS mapping against AARM (issue #213). AARM R5 requires receipt signatures verifiable offline with the public keys available.