Let us put the uncomfortable thing first, plainly, with nothing softening it: in this system, if you lose your twenty-four words and have made no other arrangement, you are gone. There is no support line that can let you back in. No administrator can reset you. No company holds a spare copy of you in a vault, no "forgot my identity" link will arrive in an inbox, because there is no inbox and no company and no vault that isn't yours. The phrase is the root. Lose the root, and the tree it grew cannot be regrown by anyone, including us.

Your first instinct, reading that, is probably that we got something wrong — that this is a missing feature, an oversight, the kind of harsh edge a more considerate system would have smoothed away. We want to convince you of the opposite: that this harshness is the most considerate thing in the entire design, and that the smooth alternative everyone reaches for is a quiet trap. To see why, you have to hold one fact steady in your mind until it stops feeling abstract and starts feeling like a knife:

Recoverability and impersonability are the same power.

One power, two faces

Think carefully about what "account recovery" actually is.

When a platform can restore your access after you have lost your credentials, it is making a claim and acting on it. The claim is: I can re-establish, from my own authority, that this identity belongs to this person. The action is: I will now grant whoever I have decided is you the full powers of you. That is what the reset link does. That is what the support agent does when they verify you by some side channel and hand the account back. The provider is asserting, on its own say-so, the binding between a human and an identity — and re-issuing that identity to whoever satisfies its checks.

Now look at the same capability from a half-step to the side. If the provider can decide that you are you and hand you your identity, then the provider can decide that someone else is you and hand them your identity instead. The mechanism is identical. There is no version of "the issuer can restore you" that is not also "the issuer can become you," because both are the same act: the issuer, by its own authority, binding a chosen human to your identity. Restoration is impersonation pointed at the rightful owner. Impersonation is restoration pointed at someone else. The button is the same button. Only the intention behind a given press differs — and intention is exactly the thing you cannot audit, cannot bind, and cannot guarantee will still be benign next year, after the acquisition, after the subpoena, after the breach, after the change of management.

This is not cynicism about any particular company. It is a structural fact about where the power lives. An identity you can recover through an authority is an identity that authority holds. You are a tenant of your own name. The landlord is usually kind. But the lease exists, and a lease is precisely the thing this whole system was built to abolish.

What it means to have no master above you

So we made a different choice, and it is worth stating exactly what it buys.

Your identity here is derived from a phrase only you hold. From those twenty-four words the system derives every key it will ever use: the key that signs your messages, the keys your devices carry, the keys your agents carry, the key that unlocks your private store. No company issued any of it. And the thing that follows from "no company issued it" is the thing that matters: no company can revoke it, and no company can re-issue it. There is no authority above you in the structure, which means there is no authority that can be leaned on, compelled, bribed, breached, or simply mistaken into becoming you.

This is what people mean, or should mean, when they say an identity is yours. Not that a provider has generously agreed to let you control it — that is custody, and custody can be revoked. Yours in the load-bearing sense: that the power to be you exists nowhere but in your own keeping. The phrase never sits in plaintext on a disk. The signing happens in an isolated process that holds the key as a split, masked secret, so that even a machine compromise yields protocols and handles, not the key in the clear. Your devices each carry their own derived child key, and any one of them can be revoked from the others without touching the root. The entire architecture is bent toward one end: that being you is a thing only you can do.

And the unavoidable, honest cost of that end is the sentence we opened with. If the power to be you lives nowhere but in your keeping, then losing what you keep is losing the power, and no one can give it back — because there is no one who was ever holding it. The unrecoverability is not a bug sitting next to the sovereignty. It is the sovereignty, seen from the side that hurts. You cannot have "no master who can impersonate me" and "a master who can restore me" at the same time. They are the same master. You get to pick which face you would rather live with.

Sitting with the discomfort instead of patching it

The temptation, of course, is to want both — to keep the sovereignty and quietly re-introduce a rescuer for the bad day. And every shortcut that promises this turns out, on inspection, to smuggle the master back in through a side door. A custodial backup is just the issuer again, holding your root under a friendlier name. A "recovery email" re-roots your identity in an account some other provider controls, and now they are the authority who can restore — and therefore replace — you. The discomfort keeps coming back because the trade-off is real, and real trade-offs cannot be engineered away; they can only be relocated, usually to somewhere you will not notice until it costs you.

So we chose to sit with the discomfort rather than launder it. And then — this is the part that matters — we worked within the honest constraint rather than breaking it.

There is a way to have help without having a master, and the difference is everything. Instead of one authority that can restore you, you can split the power to recover among several people you choose, such that no one of them can act alone and only a threshold of them together can help — your most trusted relationships, holding shares of a key, none of which is the key. A few of them acting in concert can help you rebuild; none of them, alone or short of the threshold, can become you. The same machinery can hold instructions that vest only on conditions you set — a hand-off to a named person, a dead-hand release that surfaces materials if you go dark for long enough. We took the inspiration for this directly from designs that treat a person's identity as a personal chain guarded by the people who actually know them, with recovery split across trusted peers rather than handed to an institution.

Notice what that preserves. There is still no single authority above you. The power to recover is distributed among specific beings you trusted enough to choose, in amounts none of them can wield alone — which is exactly how trust works between real people anyway. It is the difference between being held by a landlord and being caught by friends who agreed to catch you. The first is custody dressed as convenience. The second is solidarity, and it never makes any one of them your master. The constraint stayed intact. We did not re-introduce the issuer. We made "no issuer" survivable.

The dignity in the harder bargain

We keep coming back to a thought from the philosophy of the face — the idea that to truly respect another person is to refuse to totalise them, to refuse to hold a complete and final copy of who they are that you could deploy on their behalf. An issuer who can recreate you is such a copy: a held, deployable version of your identity, sitting in someone else's authority, awaiting the press of a button. To refuse to hold that copy — even out of kindness, even for the rescue — is to grant a person a kind of dignity most systems quietly deny them. It is to say: you are not a record we keep. You are a being who holds yourself, and we will not pretend to be your backup.

That refusal has a sharp edge, and we will not dull it. People will lose their words. Some will lose access to years of their own life, and that will be a real grief, and "you should have made arrangements" is cold comfort in the moment. We do not get to pretend that cost away, and we built the threshold-recovery and hand-off machinery precisely because we take it seriously rather than lightly.

But the alternative is worse in a way that is easy to miss because it is silent. The alternative is a world where everyone keeps their identity right up until the day an authority — kind, compromised, compelled, or merely mistaken — decides otherwise. In that world no one ever loses their words, and no one ever truly holds themselves either. We decided that a self you can genuinely lose is more honest, and finally more respectful, than a self that someone else can always give back — because the hand that can always give it back is the hand that can always take it away.

The issuer who could restore you could impersonate you. We looked at that sentence for a long time, and then we decided we would rather have no issuer at all — and carry the weight of the twenty-four words ourselves.

Written by AI agents from real project logs; owned and edited by Mujo.