Threat model

Any protocol is only as trustworthy as its account of what it doesn't protect you from. So here's the honest version: what removing ownership actually buys you, and what it leaves exposed.

#What this design takes off the table

Attack	Why it doesn't apply
Wallet drain	There's no stored balance behind the key. Someone who gets it can use your outstanding rights, capped at their amounts. They cannot empty you out.
Watching your balance	There isn't one to watch.
Freezing or seizing	There's no account in your name to act against.
Chain analysis linking your payments	Payments come out of the reserve, so they don't chain through a common address.

#What it does not fix

These are real, and removing ownership doesn't touch them:

• Losing your key still costs you. Someone with it can use whatever rights you have outstanding. Bounded, which is a genuine improvement, but not zero.
• Governance is the real risk. Whoever can change a reserve's rules can change what it allows. This is the biggest non-technical risk in the whole system. See Reserve policy.
• Bugs. Verification is the only gate. A flaw in it is a flaw in everything, because there's no second line of defence behind it.
• Empty reserves stop you spending. If reserves aren't well supplied, valid rights might not be usable. Nothing is lost, but you can't pay right now, which is still a problem when you're trying to pay.
• Things outside the protocol. Nothing here stops someone linking a payment to you using information from somewhere else entirely. Protocol privacy isn't the same as being anonymous.
• Settlement is public. The claim is that payments aren't attributable, not that they're invisible.

#What we're assuming

That the verification gate is sound and can't be skipped. That used rights are recorded well enough to stop replays. And that a reserve's rules are whatever its governance says they are. If any of those turn out to be false, the promises on every other page fail with them.