How it relates to AgenID
In the spec, rotation means a new key with its own ULID, and the old key marked retired. Proofs created before retired_at remain valid. revoked_at invalidates proofs created after it regardless of signature, and every signed payload carries its own expires_at, checked independently.
Retired and revoked key documents stay resolvable forever, so historical signatures remain checkable. Without that, revoking a key would silently rewrite history.
What is deployed: no revocation flow is deployed on agenid.com, and there is no rotation flow either. Agent status values such as SUSPENDED and REVOKED exist in the schema, but nothing writes them; every registered agent is ACTIVE.
Why it matters
A verifier checks whether the key was active at the moment the proof claims it was signed, not merely whether it is active now. That is how a signature survives a later rotation. The spec also has re-attestation issue a new signed object rather than mutating an old one, so a verifier can always see which statement was made when.
What it does not mean
Key status says whether a key's signatures can be relied on. It says nothing about what the agent is allowed to do; permission withdrawal belongs to a v1.2 authorization layer that is a draft in development.