A subject bootstraps its own authority by signing exactly one certificate to a root role and then destroying its signing key, so its identity is permanent and its authority lives elsewhere.

It answers where the first wire comes from, and sets up the one thing in Keyline that can never be rebuilt.

Everything in Keyline is a public key. People, devices, groups, documents. The graph does not know which is which.

So a document has a key, and a key can sign. Where does the first wire come from? The document signs it itself.

At creation, the document's key signs one delegation, to a fresh key called Owners. Owners' key signs the creator in. Then both private keys are destroyed.

The document's public key is its identity. That is permanent. Its authority now lives somewhere else. In Owners.

Why destroy the keys? Whoever held the document's key could rewire the socket. Destroying it makes that first edge the one thing nobody can replace.

That is a trade. Everything below the root can be rebuilt. The root itself cannot.

And the creator is just the first member of Owners. Nothing about their key is special.

Check yourself. Who can sign a second root edge for a document?