should an external ID point to multiple public keys (external_id zome) ?

[nphias]

seems like this current affordance could become a liability / abused

[8e8b2c]

The first concern that comes to mind for me is how to handle unintended bindings, or retiring agents. For example, a user didn't realise that they were signed in with the wrong agent when they requested the attestation. This situation needs to be rectifiable.