Revocation is a DELETE, and it hits one container

A container is acting strangely at 2pm: outbound calls it shouldn't make, a dependency nobody recognizes. On a shared-key stack this is the moment you rotate the provider key, and rotating it breaks every service that holds it. You schedule the rotation for after hours and hope.

On Hoody you PATCH {"ai": false} on that container and keep investigating. If you decide it's compromised, DELETE it. That's the whole revocation: the identity was the container, so ending the container ends the identity. The other thirty-nine containers on the box never held a shared key and never notice.

Snapshot it first if forensics wants a copy. The snapshot holds no secret either.

Revoking one machine's access costs exactly one machine.