Five-device instantiation
Recommended secure flow
Step 1: Owner creates a Key draft

The Owner selects:

Key type: Primary Author.
Label.
Scope.
Self permissions.
Child Key types.
Child permission ceilings.
Maximum delegation depth.
Maximum active children.
Expiration.
Rate limits.
Approval requirements.
Bootstrap mode.

No key is active yet.

Step 2: CRE8 creates five enrollment slots
Slot A: Authentication component
Slot B: Delegation component
Slot C: Authorship component
Slot D: Confidentiality component
Slot E: Public bundle verification

Each slot receives:

A random claim token.
An expiration.
A single-use state.
A separate short confirmation code.

Store only a hash of each claim token.

Step 3: Send claim links

A destination receives a one-time URL. The Owner dashboard separately displays the confirmation code.

Therefore, compromising only the email destination is not enough to complete the claim.

Step 4: Generate locally

The receiving device:

Opens the claim page.
Enters the confirmation code.
Generates the assigned keypair locally.
Sends the public key to CRE8.
Signs a server challenge for Ed25519 components.
Displays the private component once.
Offers:
Copy.
QR representation.
Checksummed text.
Encrypted .cre8component file.

The page should not retain the private key after navigation or refresh.

Step 5: Public verification device

After four public components have been registered, the fifth device receives:

Credential ID.
All four public keys.
Short fingerprints.
Key type.
Parent Credential ID.
Policy hash.
Creation time.

The Owner compares the fingerprints shown by the four component devices with the fifth public bundle.

Step 6: Owner activates

Only after confirmation does the logical Key become active.

Step 7: Consolidate on an authorized client

The user imports the four private components into the CRE8 client.

The resulting local file contains the complete nine-field payload and is encrypted with:

A locally entered passphrase.
Argon2id-derived encryption key.
XChaCha20-Poly1305 authenticated encryption.

The decrypted components remain in process memory only while unlocked.

Lower-assurance modes

Support:

split_5     Four private-component devices plus public verifier
split_3     Components divided across three devices
split_2     Components divided across two devices
single      All components generated on one device

Do not prohibit lower-assurance modes. Record:

Chosen mode.
Number of distinct claim clients.
Number of distinct destinations.
Whether claims came from distinct networks.
Owner acknowledgement.

Do not claim that IP addresses prove physical device or network separation. Treat them as evidence and alerting signals only.