Report vulnerabilities privately through System Locker support. Do not include license credentials, installation private keys, leases, or customer data in a public issue.

The application developer must embed an initial Nightflyer Ed25519 public-key ring through a trusted release channel. This SDK accepts a replacement key only through a signed, linear key-transition token whose old key is already trusted. Persistent state stores and replays that signed transition chain from the embedded roots; it never treats a saved expanded key ring as authority. The complete state record is also signed by the installation key.

Nightflyer verifies the signature and fixed token type before consuming lease or status claims. A valid offline lease remains valid until its signed expiry; an offline device cannot observe server-side revocation until it reconnects.

EcdsaInstallationKey is intentionally memory-only. Applications choosing persistent leases must use an OS-protected, preferably non-exportable installation key and bind persistence to the current OS user. By default, cross-reboot offline use is accepted only when UTC has not moved behind the installation-key-signed high-water checkpoint. This rejects simple wall-clock rollback while preserving normal offline restarts and time-zone changes. Software-only storage cannot distinguish every coordinated replay of an older, correctly signed snapshot and matching clock value. Set RequireOnlineAfterReboot to true to require a signed online response after each OS boot when that stricter tradeoff is appropriate.