[jsmith45]

The PLC keys are normally intended to be held by your current PDS. Not a hard protocol requirement, but without it, certain things like migrating to a custom domain handle cannot be done cleanly though the app, and would need to be done manually. It might be a requirement of the bluesky hosted PDSes though, as those have some extra requirements beyond the reference self-hosted PDS.

The fact that BlueSky runs the PLC central server is supposed to be fixed by them creating a swiss association to run and control it instead, but while they announced this, it is unclear if it went anywhere.

If you migrate to a self hosted PDS using the all-in-one migration `goat account migrate` command, it will temporarily change your handle to a subdomain of your new PDS, and leave the new PDS managing the PLC. You can instead perform each step manually via goat or raw API calls, either of which would let you transition to direct PLC key management, and/or a new domain based handle as a single atomic plc update, as part of the overall migration process.

See https://atproto.com/guides/account-migration for a discussion of the process at the protocol level. See https://whtwnd.com/bnewbold.net/3l5ii332pf32u for a breakdown of both the automated, and step by step process via `goat`. It does not go into the details of switching to self managed, but it basically requires crafting your new PLC document, sending that one to the old PDS to sign, and then submitting the result. There are manual PLC signing, and submission commands available as `goat plc` subcommands, for use once you have manual control.

[kmeisthax]

This more or less answered my question in exactly the way I was dreading.

The option to register and manage PLC rotation keys should be built into the Bluesky Appview itself, sitting right next to the existing option to verify a domain with your did:plc string. Having the option only exist as a command line tool means most people aren't going to use it and third-party PDS hosts are going to be a pain in the ass to use for people with data already on Bluesky's PDS.

I'm also not happy about the existence of the PLC directory at all, mostly because it's not really explained all that well in the Bluesky interface. I assumed PDSes were just identified by their domain name (like a Mastodon instance is) - and while that is an option with did:web, it's not the default option, and you cannot migrate an identity between PLC and DNS governance. Hopefully that will change.

[Hoodedcrow]

> The fact that BlueSky runs the PLC central server is supposed to be fixed by them creating a swiss association to run and control it instead, but while they announced this, it is unclear if it went anywhere.

That I didn't know! So... Basically the whole solution is still "trust me bro"?

[kmeisthax]

Kind of. From what I've been told, the non-trust-me-bro solution is did:web, which is just "you host a file on a web server containing all the same information the PLC serves". Problem is, if you already have a did:plc, you're stuck with it - you cannot migrate off a DID, as it's intended to be about as immutable as an SQL primary key.

There are also read-only mirrors of the PLC, but that doesn't really matter, given that the whole point of the PLC is to be a trusted[1] entity for arbitrating identity conflicts. This is necessary because the PLC is what lets you register new signing keys to overrule an uncooperative PDS - otherwise, you have the moral equivalent of Mastodon instances where an instance admin can hold your identity hostage.

And, technically speaking, did:web is also "trust-me-bro", in the sense that it ultimately relies on DNS to resolve names to servers. DNS and PLC are moral equivalents[0] in that ultimately there is a central authority to arbitrate disputes over who owns what identities. In fact, there kind of has to be. Every proposal for a true distributed identity system ultimately boils down to either pinning a self-signed key or web-of-trust, both of which have undesirable failure modes due to the lack of a central trusted authority.

Ultimately, the choice comes down to: do you want to pay the DNS people $15/yr for a zone to host your DID on, or do you trust Bluesky's PLC server to offer that hosting for free?

[0] Almost. In practice, DNS is a recursively nested set of central governors; every TLD imposes an additional governor on top of ICANN root zone management. In practice, almost all DNS shenanigans happen at registrars; and of the shenanigans not caused by registrars, most of them happen at the TLD operators and not the root zone itself.

[1] PLC stores all identity updates in an append-only log. I'd call it a blockchain, but the Bitcoin people ruined that term. Practically speaking, if the PLC were to "turn evil" and mess with people's identities there'd be irrefutable proof of it. How much this assuages your concern depends on what you think about Certificate Transparency.

[Hoodedcrow]

Big thanks for clearing that out! Makes sense.