An account in Hypermedia is a key pair. The public key is the account's identifier and appears in every address that belongs to it. The private key never leaves the author's device, or the encrypted vault the author chose to keep it in. There is no registration server: creating an account means generating a key.

You get a stable identity that no company can suspend, and you can stay pseudonymous if you want. Losing the key is serious. Seed stores it in the operating system keychain or in a zero-knowledge vault, and a 12-word recovery phrase rebuilds it. Identity has the details, including how browser sessions and devices act for an account without holding its key.

Each signed blob carries the signer's public key and a signature over the canonical encoding of everything else in it. A reader checks three things: the encoding is well-formed, the signature matches the signer, and the signer is allowed to do what the blob says. The third check is where permissions come in. A change to a document is accepted only if the signer owns the document's space or holds a capability from the owner.

Signatures cover the content itself, so a gateway or a peer that relays the data cannot alter it without being caught. It cannot sign for you, and it cannot delete the data for good if someone else has a copy. A gateway can still refuse to serve you, serve a stale version, or log who asks for what. Running your own node removes those risks, and any Seed site is a full node.

People ask why the team did not build on ActivityPub. ActivityPub brought federation to the mainstream, and that matters. It solves a different problem.

Content integrity. In ActivityPub, content lives on servers and can be changed at any time. Nothing built in lets you verify that what you read is what the author wrote. You trust the server.

Permanent links. When a server shuts down, every link to content on it breaks. The content may survive somewhere as a backup, but the addresses stop working, because each link names a server.

Author signatures. ActivityPub signs the messages servers send each other. It does not sign the content. You trust the server operator instead of the author.

These were reasonable choices for a standard meant to federate social interactions and be easy to adopt. Content that stays verifiable and linkable while servers come and go needs different foundations: content signed by authors, addressed by hash, and replicated by anyone who cares about it. That approach has costs too. It is harder to build and harder to explain, and the tooling is younger. The team thinks there is room for both.

Timestamps are declared by the signer and nothing proves them. Capabilities cannot yet be revoked or given an expiry. Anyone can comment on anything, and moderation is each node's choice. The "web of trust" that would rank strangers by your contacts' endorsements is a stated goal with no code behind it. Today a contact is a public statement that you know an account by a name, and it grants nothing. Where this is going tracks the redesign.