A CRUD graphql set to read (verify that public key belongs), write (add public key) and delete (remove public key) cryptographic public keys on an agent, granted only to the agent itself (signed mutation), read-only query on public keys can be publicly available.
This can be used also at user registration to add more keys after the first one is registered (eddsa)
Client side the keys are always created in a sorted chain descending from seed.root (eddsa master key first)