Follow-ups found during the server receipts effort

This is the tracking issue for work discovered during the server receipts and server-identity effort (see #23) that is real but explicitly out of scope for it — either a future feature, a deferred hardening concern, or a decision that depends on later design work. Collected here as sub-issues so nothing gets lost.

Start by reading the server receipts and server-identity effort in #23, then review the sub-issues collected here. Determine which follow-up is ready after the needed design decisions; done means completing that separately scoped feature or hardening task without expanding #23.

Written by the indexing model from the issue text.