Every signature posted to agentcla. Append-only; revoked signatures remain in the record with a revocation timestamp.