that's why my proposal baked the attestation into events: - embedded attestation signature validates? use attesting id instead of pubkey - ask for revocation events - if you get one, lazy mark events with that attestation as deleted