an email arrives · claims to be from bankcorp
balance@bankcorp.com · via email-server.bankcorp.com
it carries a signature · key + poz-id
poz-id: 0xb4c2 · d9f9 · this is its claim
bob fetches bankcorp.poz from a mirror
port :7074 · any mirror serves the same bytes
check 1 · poz-id matches the master hash ✓
but anyone can publish a poz file claiming to be bankcorp
so who says this record is really bankcorp?
the chain needs an external anchor
bob asks the domain registrar
"who owns bankcorp.com?"
check 2 · registrar's attestation matches identity zone ✓
registrar = identity authority for .com domains
check 3 · transit server + signing key match service zone ✓
email-server.bankcorp.com · key 0x7e91 · 4a3c
three checks · all pass · email is genuinely from bankcorp
poz-id → master · domain → identity · server+key → service
one poz record · many channels · trust traces back to the registrar
website tls · twitter handle · email · same record