The roleless tripwire: implements sign/2 + public_key/1 + thumbprint/1 + key_identity/1 but OMITS signing_identity/1. sign_grant must reject it as :invalid_key_handle (the UndefinedFunctionError from apply/3 is caught by safe_callback). key_identity/1 is included to prove the rejection is role-specific (signing_identity absent), not key-identity-specific.