Fair comparison but this does not delegate authority or introduce permissions or revocation logic. CRI just anchors rotating keys to a single offline root via a deterministic signature that clients can verify with no protocol changes.