@ediosyncratic key revocation is done by deleting the RSA key file, in /var/cfengine/ppkeys. In general our trust model resembles the SSH one. We do *not* support CAs, we do *not* store X509 certificates anywhere. Let me know if you want to discuss this in depth.