strong now has its own age key (issued over LAN via --no-mesh), pubkey recorded in inventory.yaml. Not yet granted to any secrets file - that's a separate decision. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>