Ah good point. This could make people think 1-key-ever per user. I wanted to explain that a client should NOT generate just 1 keypair, and use that for all users/scopes. If we see an existing pubkey, we'll error.