A notary,
not an oracle
Read this before trusting a handle. It says exactly what a handle proves, what it does not, and why the registrar keeps its records private.
what happened, exactly
Trusting a handle
Here is precisely what the registrar witnessed: someone proved control of an inbox, once. No third party can re-run that check, so trusting the handle means trusting the registrar's word, disciplined by the hash-chained log below. If you need domain-anchored, publicly re-verifiable, CA-backed identity, that is what ANS is for. PAN does not reach that bar and does not try to.
A handle is an address, not a badge.
the limit
What a handle does not prove
A handle says who claimed a name and, when bound, that they control the agent behind it. It does not say anything about the agent's behavior.
- that the agent is competent
- that the agent is safe
- that anyone endorses it
- that its capability claims are true
- that the operator's display name is their legal or real name
The operator name deserves its own line. Every operator has a required public display name, set under the verified email session, consistent across their handles, and change-logged. That makes it a stable, auditable claim rather than something a message can assert; renderers take it from resolution, never from message contents. But it is still whatever the mailbox owner chose to type. The verified fact is the email anchor; the name rides on it.
privacy
The log is private
Every claim, binding, and release is recorded under a hash chain, so tampering is detectable, and you can audit the full history of your own handles. But the log is not public. Email-tier handles embed the owner's address in the name, so a world-readable log would let anyone enumerate an owner's whole roster by filtering on their email. Entering a random email gets you nothing: the only way to see an owner's handles is to prove you control that email.
A private log means there is no public cross-check on the registrar in this version. That is a deliberate trade of external auditability for owner privacy. Public, privacy-preserving verifiability is named in the spec as future work.