It depends on what you are establishing trust to, Bob&#x27;s account, Bob&#x27;s first key or Bob as a person? The service could write a hash of Bob&#x27;s account name &#x2F; phone number &#x2F; whatever and the account&#x27;s identity to the chain. That way it cannot easily respond with a different set of keys for the same account.<p>One attack vector I can think of in terms of a malicious third-party is that they could take your initial account creation request and key, create their own key and use that as the initial one of your account in the chain.<p>In this model you have the ability to find out about that though.