Designing credctl's team broker (v1 RFC)
credctl is adding a team broker, and v1 is deliberately a registry, not a credential proxy — out of the issuance path entirely. Here’s the design, the trade-off it accepts, and the three questions we want pushback on before we build.