The atomic-snapshot drift tripwire for sign_grant (the design-adversarial TOCTOU fix). signing_identity/1 returns a consistent {:issuer, kid_a, pub_a} snapshot, then flips internal state so sign/2 signs with priv_b (a simulated post-snapshot rotation). The atomic snapshot means role+kid+pub cannot drift apart; the verify_signature guard catches the sign/2-vs-snapshot mismatch -> :signing_failed, never a silent false-success. The handle term is an Agent pid whose state is %{kid:, pub_a:, priv_a:, priv_b:, rotated:}.