I think verifiable key history needs to be addressed. I think it can be simply done with an array of {key,nbf,exp} that is signed in the did.json or nostr.json served up by a nip05 server.