Draft — this page will cover: the credential format, rotation without downtime, and what revocation breaks.