Follow-ups found during the server authentication effort

This is the tracking issue for work discovered during the server authentication and principal-lifecycle effort (see #23) that is real but explicitly out of scope for it — either because it's a future feature, a deferred hardening concern, or a decision that depends on later design work. Collected here as sub-issues so nothing gets lost.

Start by reading the server authentication effort in #23 and review the sub-issues collected here. Identify one follow-up with a settled scope before beginning; this tracking issue is done only when its deferred work is separately scoped or resolved.

Written by the indexing model from the issue text.