Re-adding a key revives every certificate it ever issued, with the same hashes and provenance. That is a one-certificate repair and a hazard, so a removal after key compromise must come back with a fresh key.

It decides what removing someone actually does, and the fresh-key rule is the one operational habit everyone needs.

When Dan removed Alice, Carol went dark. Carol's certificate is dead. Not revoked. Now the difference matters.

Dan re-adds Alice. Her strip is plugged back in. Carol lights up. And so does everything else Alice ever wired. Same certificates. Same hashes.

As a repair, that is wonderful. Remove by mistake, re-add, and the whole subtree returns for one certificate. Everyone except Eve? One re-add, one revocation.

As a hazard, it is the same thing. Re-add a key, and you revive certificates everyone forgot. Including ones a thief signed while they held that key.

So, after a compromise, re-add the person with a fresh key. The old key never returns. Its certificates stay dead forever.

And when a removal must survive any future re-add, revoke what they issued, not just their membership. Explicit revocations are permanent.

Three kinds of removal. Implicit: reversible. It revives on re-add. Explicit: durable. What you keep must be re-issued. Fresh key: the old key simply never comes back.

Dead and revoked are different states. The difference is one question. Will it come back?

Check yourself. Alice's key was stolen and she was removed. Later "Alice" is re-added with the same key. What happens?