Naked-revoke acknowledgment is unsigned even for an attestor server

The server's response to an accepted naked revoke is an unsigned envelope, even when the server is configured with its own principal (an attestor). The signed-receipt machinery exists for other responses, but the signed-acknowledgment shape for a revoke is not specified — it falls in the post-§11 region of the spec.

This is deliberate for now: an unsigned envelope is an honest "this is server-local truth, not a portable trust object a client replays," and inventing an unspecified signed statement or duplicating the sign-and-compose path into the revoke handler would be premature. Filing so the decision is visible and can be revisited once the spec defines whether — and in what shape — a revoke acknowledgment should be signed.

No file, test, or entry point is named; start by locating the accepted naked-revoke response, revoke handler, and existing signed-receipt machinery. Done means the specification defines whether and in what shape an attestor server signs revoke acknowledgments, after which implementation scope can be assessed.

Written by the indexing model from the issue text.