The article is very light on details about the key used to sign changes of the DID (when the article says "all changes to their data" I guess it refers to the D

The article is very light on details about the key used to sign changes of the DID (when the article says "all changes to their data" I guess it refers to the DID?) But suppose I'm user foobar.bsky.social (appologies to the actual foobar). I've created this identity on bluesky, I do not remember having uploaded a key, or being ofered to download one. Where is that key exactly? Who owns it? And how/when is it used? Also, if the did is hosted on plc.directory, what mechanism prevent whoever controls that website to overwrite my did and impersonate me?