The receiving context verify_commitment/2 compares a receipt against: trusted keys, the issuer/subject/audience pins (each nil = the receiver does not pin that member), and the previously-verified terminal facts for conflict detection.

Key attribution: issuer_key_sets (when non-nil) takes precedence over the flat keys pool — the receipt's claimed issuer member selects the pool for the signature attempt, so org-B's key never verifies a receipt claiming org-A for receivers expressing the stricter model. An empty map trusts no issuer (deny-all, never a fallback). The claim is proven signed by the binding step after the attempt; a false claim only ever narrows to the wrong or empty pool.

Freshness: created_after/created_before are RFC 3339 Z-form bounds on the SIGNED created_at (inclusive both ends; the receiver supplies the window, the package never invents a clock). Checked after conflict detection — integrity and consistency outrank receiver policy. Verification context is caller-supplied data that carries no authority. Verification context is caller-supplied data that carries no authority.