How is the key handling being done? If the .identity file is signed, then workstations will need to look up the key on some keyserver to see if the key has been

How is the key handling being done? If the .identity file is signed, then workstations will need to look up the key on some keyserver to see if the key has been revoked. This also limits use to online-only. Without key revokation and online-only, ex-employees plugging in their home directories and regaining their employee privileges, because the trusted .identity file says they are in the staff group.