- namespace grant service becomes a signing service where each service will need to issue its own grant challenge that must be validated via the namespace grant service
- the previous model had an obvious security flaw which would allow any rogue application to obtain a single grant ID that could indefinitely be used for any lockbox service once granted to one lockbox (i.e. not good)