diff --git a/README.md b/README.md
index e2774d5..8f072e1 100644
--- a/README.md
+++ b/README.md
@@ -76,8 +76,8 @@ The daemon binds loopback and nothing else, so reaching it from elsewhere is
 opt-in and takes one command:
 
 ```sh
-flue relay setup                                   # machine 1: paste a Cloudflare token
-flue relay join wss://<your-relay> --secret <...>  # every other machine
+flue relay setup                                                 # machine 1: paste a Cloudflare token
+flue relay join wss://<your-relay> --secret <...> --fleet <...>  # every other machine
 ```
 
 That deploys a Worker **and** this web app into your own Cloudflare account,
diff --git a/cmd/flue/main.go b/cmd/flue/main.go
index e54a1ce..a07d806 100644
--- a/cmd/flue/main.go
+++ b/cmd/flue/main.go
@@ -25,6 +25,7 @@ import (
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/service"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
@@ -106,7 +107,7 @@ const usageText = `flue — your terminal, as a browser tab
   flue disable            remove the login service
   flue status             daemon, login service, and session diagnostics
   flue relay setup        deploy a relay to your own Cloudflare account
-  flue relay join URL --secret S   point this machine at an existing relay
+  flue relay join URL --secret S --fleet K   point this machine at an existing relay
   flue relay status       show the configured relay
   flue relay update       redeploy this release's relay; secret and pairings kept
   flue relay address URL  repoint this machine at a custom domain on the same relay
@@ -323,7 +324,27 @@ func loadIdentity() (daemon.Identity, error) {
 	if err != nil {
 		return daemon.Identity{}, fmt.Errorf("load the daemon static key: %w", err)
 	}
-	return daemon.Identity{Key: key, Devices: crypto.NewDeviceStore(dir)}, nil
+	id := daemon.Identity{Key: key, Devices: crypto.NewDeviceStore(dir)}
+
+	// The fleet key rides relay.json (spec/fleet-trust.md), so it is read
+	// here beside the other identity material rather than by the relay
+	// startup: pairing mints device certs and revocation mints revocations
+	// whether or not the transport ever comes up. An unreadable or absent
+	// relay.json leaves the identity fleet-less — startRelay reports the
+	// unreadable case, and a daemon without a fleet key pairs exactly as it
+	// always did. A relay.json that parses but carries a seed this daemon
+	// cannot use is fatal, by the same reasoning as the static key above: a
+	// daemon that started anyway would sign nothing and verify nothing while
+	// looking perfectly healthy, and a corrupted credential file is a thing
+	// to say out loud, not to route around.
+	if rc, ok, err := config.LoadRelay(); err == nil && ok && rc.FleetSeed != "" {
+		fk, err := fleet.Parse(rc.FleetSeed)
+		if err != nil {
+			return daemon.Identity{}, fmt.Errorf("relay.json carries a fleet seed this daemon cannot use: %w", err)
+		}
+		id.Fleet = fk
+	}
+	return id, nil
 }
 
 // startRelay dials the configured relay, if there is one, and keeps it dialled
@@ -359,7 +380,38 @@ func startRelay(ctx context.Context, srv *daemon.Server, identity daemon.Identit
 		return false
 	}
 
-	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID}
+	// The public half only: signing stays with the daemon (pairing,
+	// revocation), while the transport verifies the certs strangers present.
+	//
+	// Parsed from the file this function just read rather than taken from
+	// identity.Fleet, which is the same value only at boot. The path where
+	// they differ is the one that matters: a relay deployed from the Remote
+	// screen writes a brand-new relay.json — fresh secret, fresh fleet key —
+	// and then calls this in a process whose boot-time identity has no fleet
+	// key at all, or an older one. Reading it from the identity there would
+	// hand relay.New a nil public key, have it refuse the relay the user had
+	// just deployed, and leave one log line behind.
+	//
+	// What still waits for a restart is the *signing* half: Identity is fixed
+	// at construction, so a daemon that deployed a relay from the screen
+	// verifies its fleet's certs from this moment and mints none of its own
+	// until it comes back. relayUIService.Provision says so in its steps; a
+	// nil Public() here, meanwhile, means relay.json carries no fleet key at
+	// all, which relay.New refuses by name (spec/fleet-trust.md keeps no
+	// compatibility with pre-fleet files, deliberately).
+	//
+	// A seed that does not parse costs remote access and nothing else, like
+	// every other fault here. loadIdentity is the one that refuses a bad seed
+	// outright, and it has already run by the time this does.
+	var fleetKey fleet.Key
+	if rc.FleetSeed != "" {
+		fleetKey, err = fleet.Parse(rc.FleetSeed)
+		if err != nil {
+			logger.Warn("relay not started", "err", err)
+			return false
+		}
+	}
+	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID, FleetPub: fleetKey.Public()}
 	t, err := relay.New(cfg, srv, identity.Key, identity.Devices, logger)
 	if err != nil {
 		logger.Warn("relay not started", "err", err)
@@ -1296,10 +1348,12 @@ func relayLine() string {
 	}
 
 	// A file the daemon will not dial must not be reported as "configured".
-	// This is the report somebody reads to find out why remote access does not
-	// work, and the faults are the ones relay.New refuses: a missing field, or
-	// — only possible by hand — both kinds of credential at once, which cannot
-	// be resolved into one dial. The problems are named; no value ever is.
+	// This is the report somebody reads to find out why remote access does
+	// not work, and the faults listed are exactly the ones relay.New refuses
+	// — a field it requires and this file does not carry. Keeping the two
+	// lists in step is a standing obligation: a fault relay.New grows and
+	// this one does not is a daemon that silently stops dialling while every
+	// report says it is fine. The problems are named; no value ever is.
 	if problems := relayProblems(rc); len(problems) > 0 {
 		return fmt.Sprintf("relay:    configured, but not usable (%s): the daemon will not dial it",
 			strings.Join(problems, ", "))
@@ -1328,6 +1382,18 @@ func relayProblems(rc config.Relay) []string {
 		// the fix, and mints one.
 		problems = append(problems, "no machine id")
 	}
+	if rc.FleetSeed == "" {
+		// A relay.json from before the fleet key existed. relay.New refuses
+		// it by name (spec/fleet-trust.md keeps no compatibility with
+		// pre-fleet files, deliberately), so this daemon dials nothing at all
+		// — which is the whole reason it is listed here: the upgrade that
+		// produces this state is silent otherwise, one stderr warning at
+		// startup and a status line that used to say everything was fine.
+		// The fix is a join line carrying `--fleet`: re-run the one printed
+		// by `flue relay setup` on a machine that has it, or re-run setup
+		// itself, which mints a fresh fleet key with the fresh secret.
+		problems = append(problems, "no fleet key")
+	}
 	return problems
 }
 
diff --git a/cmd/flue/main_test.go b/cmd/flue/main_test.go
index 0aeef48..4d76f6f 100644
--- a/cmd/flue/main_test.go
+++ b/cmd/flue/main_test.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
 )
@@ -1261,6 +1262,7 @@ func TestStatusReportsAConfiguredRelayWithoutItsSecret(t *testing.T) {
 		Origin:      "https://flue-relay.example",
 		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
 		MachineName: "Karn's MacBook Pro",
+		FleetSeed:   testFleetSeed,
 	}); err != nil {
 		t.Fatalf("SaveRelay: %v", err)
 	}
@@ -1276,6 +1278,12 @@ func TestStatusReportsAConfiguredRelayWithoutItsSecret(t *testing.T) {
 	if strings.Contains(out, secret) {
 		t.Fatalf("status printed the daemon secret:\n%s", out)
 	}
+	// The fleet key is the other credential relay.json holds, and the newer
+	// one: it signs every cert the fleet trusts, so a status output pasted
+	// into a bug report must not carry it either.
+	if strings.Contains(out, testFleetSeed) {
+		t.Fatalf("status printed the fleet key:\n%s", out)
+	}
 }
 
 // --- the relay leg of serve ---
@@ -1306,17 +1314,27 @@ func TestStartRelayDialsAConfiguredRelay(t *testing.T) {
 		Origin:      "https://r.example",
 		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
 		MachineName: "Karn's MacBook Pro",
+		FleetSeed:   testFleetSeed,
 	}); err != nil {
 		t.Fatalf("SaveRelay: %v", err)
 	}
 
+	// The identity serve would have built: the same file's seed, parsed. The
+	// relay leg refuses to start without a fleet key, so a zero Identity here
+	// would test nothing but that refusal.
+	fk, err := fleet.Parse(testFleetSeed)
+	if err != nil {
+		t.Fatalf("fleet.Parse: %v", err)
+	}
+	id := daemon.Identity{Fleet: fk}
+
 	srv := daemon.New(session.NewRegistry(time.Now), local.NewAuth("0123456789abcdef", 0),
-		uiHandler(), version, daemon.Identity{})
+		uiHandler(), version, id)
 	t.Cleanup(srv.Shutdown)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	startRelay(ctx, srv, daemon.Identity{})
+	startRelay(ctx, srv, id)
 
 	deadline := time.Now().Add(3 * time.Second)
 	for attempts.Load() == 0 {
@@ -1396,13 +1414,20 @@ func TestStatusReportsAnIncompleteRelayConfig(t *testing.T) {
 		relay config.Relay
 		want  string
 	}{
-		{"no url", config.Relay{Secret: secret, Origin: "https://r.example", MachineID: "m-0001"}, "no url"},
-		{"no secret", config.Relay{URL: "wss://r.example", Origin: "https://r.example", MachineID: "m-0001"}, "no secret"},
-		{"no origin", config.Relay{URL: "wss://r.example", Secret: secret, MachineID: "m-0001"}, "no origin"},
+		{"no url", config.Relay{Secret: secret, FleetSeed: testFleetSeed, Origin: "https://r.example", MachineID: "m-0001"}, "no url"},
+		{"no secret", config.Relay{URL: "wss://r.example", FleetSeed: testFleetSeed, Origin: "https://r.example", MachineID: "m-0001"}, "no secret"},
+		{"no origin", config.Relay{URL: "wss://r.example", Secret: secret, FleetSeed: testFleetSeed, MachineID: "m-0001"}, "no origin"},
 		// A relay.json from before machines had ids, or one hand-edited into
 		// that shape: the daemon will not dial it (relay.New refuses), so the
 		// status line has to say why rather than call it configured.
-		{"no machine id", config.Relay{URL: "wss://r.example", Secret: secret, Origin: "https://r.example"}, "no machine id"},
+		{"no machine id", config.Relay{URL: "wss://r.example", Secret: secret, FleetSeed: testFleetSeed, Origin: "https://r.example"}, "no machine id"},
+		// The one an upgrade produces on its own: a relay.json written before
+		// the fleet key existed is complete by every older rule and refused by
+		// relay.New (spec/fleet-trust.md keeps no compatibility with those).
+		// Until this case existed, that machine lost remote access while
+		// `flue status`, `flue relay status` and /api/relay/info all called it
+		// configured and fine.
+		{"no fleet key", config.Relay{URL: "wss://r.example", Secret: secret, Origin: "https://r.example", MachineID: "m-0001"}, "no fleet key"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Setenv("XDG_CONFIG_HOME", t.TempDir())
diff --git a/cmd/flue/relay.go b/cmd/flue/relay.go
index 99e0d0d..7a3afa2 100644
--- a/cmd/flue/relay.go
+++ b/cmd/flue/relay.go
@@ -19,6 +19,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaydeploy"
 	relaybundle "github.com/karnstack/flue/relay"
 	"github.com/karnstack/flue/web"
@@ -273,6 +274,20 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 	}
 	origin := "https://" + host
 
+	// The fleet key, minted beside the fresh secret and — unlike it — never
+	// sent anywhere: no binding, no secret upload, no log line
+	// (spec/fleet-trust.md). It travels only in relay.json below and in the
+	// join line printed at the end, and it is what signs the device certs
+	// every machine on this relay honours. Fresh on every setup for the same
+	// reason the secret is: setup is the recovery path, and rotating the
+	// fleet key is what un-trusts every cert a compromised machine could
+	// have signed.
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		return err
+	}
+	fmt.Fprintln(w, "  ✓ fleet key minted (stays on your machines; Cloudflare never sees it)")
+
 	// This machine's identity on the relay: the id is the slot it dials
 	// (/daemon/<id>) and the name is its human label. Minted fresh on every
 	// run like the secret — setup is the recovery path, and a stale id would
@@ -297,6 +312,7 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://" + host,
 		Secret:      secret,
+		FleetSeed:   fleetKey.Seed(),
 		Origin:      origin,
 		MachineID:   machineID,
 		MachineName: machineName,
@@ -318,11 +334,15 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 		}
 	}
 
-	// The one line another machine needs, exactly as it should be run there.
-	// It carries the secret — that is the point: the relay is shared by
-	// machines that share it, and this is the deliberate hand-off, printed
-	// once at the moment the user is wiring their fleet up.
-	fmt.Fprintf(w, "\nto add another machine, run this on it:\n\n  flue relay join wss://%s --secret %s\n", host, secret)
+	// The one line another machine needs, exactly as it should be run there,
+	// spelled by joinCommand so this print and the Remote screen's copy can
+	// never drift. It carries the secret and now the fleet key — that is the
+	// point: the relay is shared by machines that share them, and this is
+	// the deliberate hand-off, printed once at the moment the user is wiring
+	// their fleet up. Its weight changed when the fleet key came aboard:
+	// leaking this line used to buy disruption, and now it buys the fleet —
+	// docs/RELAY.md says so where it teaches the line.
+	fmt.Fprintf(w, "\nto add another machine, run this on it:\n\n  %s\n", joinCommand(host, secret, fleetKey.Seed()))
 
 	fmt.Fprint(w, relaySetupDone)
 	return nil
@@ -333,7 +353,7 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 // a machine list rendering as a list.
 const machineNameMaxRunes = 64
 
-const relayJoinUsage = "usage: flue relay join <url> --secret <secret> [--name <label>]"
+const relayJoinUsage = "usage: flue relay join <url> --secret <secret> --fleet <fleet key> [--name <label>]"
 
 // relayJoinDone mirrors relaySetupDone's restart note without the token line:
 // join never saw a Cloudflare credential, so there is nothing to tell the user
@@ -360,6 +380,7 @@ func runRelayJoin(w io.Writer, args []string) error {
 	fs := flag.NewFlagSet("relay join", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	secret := fs.String("secret", "", "the relay's daemon secret, from flue relay setup")
+	fleetSeed := fs.String("fleet", "", "the fleet key, from flue relay setup")
 	name := fs.String("name", "", "a display name for this machine (defaults to the hostname)")
 	if err := fs.Parse(args[1:]); err != nil {
 		return fmt.Errorf("%w; %s", err, relayJoinUsage)
@@ -370,6 +391,27 @@ func runRelayJoin(w io.Writer, args []string) error {
 	if *secret == "" {
 		return errors.New("no --secret was given; " + relayJoinUsage)
 	}
+	// Required unconditionally, not "when the relay was set up with one".
+	// Join is a local command — it never talks to the relay, so it cannot
+	// ask how setup ran — and every setup from this flue on mints a fleet
+	// key, so the only line without --fleet is one printed by an older
+	// setup, whose relay the compatibility rules retire anyway
+	// (spec/fleet-trust.md): its ids stopped routing on the Worker this
+	// binary deploys, and the fix is re-running setup, which prints a line
+	// this check accepts. One rule, no state to consult, and a lost flag —
+	// the ordinary paste accident — is caught here rather than as a daemon
+	// that quietly cannot admit its fleet's devices.
+	if *fleetSeed == "" {
+		return errors.New("no --fleet was given; " + relayJoinUsage)
+	}
+	fleetKey, err := fleet.Parse(*fleetSeed)
+	if err != nil {
+		// The parse error says what the value failed to be (base64url, 32
+		// bytes) and never echoes it: the seed is the fleet's signing key,
+		// and a near-miss paste is close enough to the credential to keep
+		// out of the transcript.
+		return fmt.Errorf("--fleet: %w", err)
+	}
 	if utf8.RuneCountInString(*name) > machineNameMaxRunes {
 		return fmt.Errorf("--name is longer than %d characters", machineNameMaxRunes)
 	}
@@ -395,10 +437,14 @@ func runRelayJoin(w io.Writer, args []string) error {
 
 	// The same shape setup writes, derived the same way: bare wss:// URL, the
 	// https origin on the same host. SaveRelay is 0600 — the file holds the
-	// relay's whole credential.
+	// relay's whole credential, the fleet key now included. The seed is
+	// stored as the parsed key re-spells it, which for a value that passed
+	// fleet.Parse is the input verbatim; going through the round trip means
+	// the file can only ever hold a spelling Parse accepts.
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://" + host,
 		Secret:      *secret,
+		FleetSeed:   fleetKey.Seed(),
 		Origin:      "https://" + host,
 		MachineID:   machineID,
 		MachineName: machineName,
diff --git a/cmd/flue/relay_test.go b/cmd/flue/relay_test.go
index 353b569..0e13da4 100644
--- a/cmd/flue/relay_test.go
+++ b/cmd/flue/relay_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	relaybundle "github.com/karnstack/flue/relay"
 	"github.com/karnstack/flue/web"
 )
@@ -32,6 +33,11 @@ import (
 // coincidence.
 const setupToken = "cf-token-must-never-be-printed-or-stored"
 
+// testFleetSeed is a fleet key spelled the way the join line spells one: 32
+// bytes, unpadded base64url. Fixed rather than minted, so a test that asserts
+// on a rebuilt join line can name the string it expects.
+const testFleetSeed = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
+
 // --- the fake Cloudflare API -------------------------------------------------
 
 // manifestLine is one entry of the asset upload session's manifest.
@@ -579,6 +585,26 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 		t.Fatalf("the saved secret decodes to %d bytes, want %d", len(raw), 32)
 	}
 
+	// The second credential, which is the whole of stage 2: setup mints a
+	// fleet key, persists it here, and hands it on in the join line. A
+	// regression that dropped `FleetSeed:` from this SaveRelay would leave
+	// every machine that joined afterwards unable to start its relay leg at
+	// all (relay.New refuses a config without one) — and, before this
+	// assertion existed, would leave the suite green.
+	if _, err := fleet.Parse(saved.FleetSeed); err != nil {
+		t.Fatalf("relay.json fleet_seed = %q, want a key fleet.Parse accepts: %v", saved.FleetSeed, err)
+	}
+	// And it went to Cloudflare in no shape at all — not as the secret, not
+	// as a binding, not in the uploaded module. That is the property the
+	// whole design rests on (spec/fleet-trust.md): the Worker gates routing
+	// and holds nothing that signs.
+	if f.secretText == saved.FleetSeed {
+		t.Fatal("the fleet key was uploaded as the worker's secret")
+	}
+	if hits := configFilesContaining(t, saved.FleetSeed); len(hits) != 1 || filepath.Base(hits[0]) != "relay.json" {
+		t.Fatalf("the fleet key should be in relay.json and nowhere else, got %v", hits)
+	}
+
 	// The URL is the bare host — the /daemon/<machine id> leg is the
 	// transport's to append, so a relay.json is one machine's whole
 	// registration: address, credential, and which machine it is.
@@ -611,7 +637,10 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 		fmt.Sprintf("✓ web app uploaded (%d files)", len(files)),
 		"✓ secret set",
 		"✓ reachable at https://" + host,
-		"flue relay join wss://" + host + " --secret " + saved.Secret,
+		"✓ fleet key minted",
+		// Both credentials, exactly as saved: the line is the hand-off, and
+		// a line missing --fleet is one `flue relay join` refuses outright.
+		"flue relay join wss://" + host + " --secret " + saved.Secret + " --fleet " + saved.FleetSeed,
 		"token stored for one-click updates",
 	} {
 		if !strings.Contains(transcript, want) {
@@ -898,7 +927,7 @@ func TestRunRelayJoinWritesTheRelayConfig(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
 	var out bytes.Buffer
-	if err := runRelayJoin(&out, []string{"wss://flue-relay.karn.workers.dev", "--secret", "s3cr3t-from-setup"}); err != nil {
+	if err := runRelayJoin(&out, []string{"wss://flue-relay.karn.workers.dev", "--secret", "s3cr3t-from-setup", "--fleet", testFleetSeed}); err != nil {
 		t.Fatalf("runRelayJoin: %v", err)
 	}
 
@@ -913,6 +942,13 @@ func TestRunRelayJoinWritesTheRelayConfig(t *testing.T) {
 	if saved.Secret != "s3cr3t-from-setup" {
 		t.Fatalf("relay.json secret = %q, want the one given", saved.Secret)
 	}
+	// The other half of the line, and the half nothing else can replace: a
+	// join that persisted the secret and dropped the fleet key would write a
+	// relay.json this daemon refuses to dial (relay.New), which is a machine
+	// that joined and then silently has no relay leg.
+	if saved.FleetSeed != testFleetSeed {
+		t.Fatalf("relay.json fleet_seed = %q, want the one given (%q)", saved.FleetSeed, testFleetSeed)
+	}
 	assertMachineIDMinted(t, saved.MachineID, saved.Secret)
 	hostname, err := os.Hostname()
 	if err != nil {
@@ -957,7 +993,7 @@ func TestRunRelayJoinNormalizesTheAddress(t *testing.T) {
 			t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
 			var out bytes.Buffer
-			if err := runRelayJoin(&out, []string{tc.arg, "--secret", "s"}); err != nil {
+			if err := runRelayJoin(&out, []string{tc.arg, "--secret", "s", "--fleet", testFleetSeed}); err != nil {
 				t.Fatalf("runRelayJoin(%q): %v", tc.arg, err)
 			}
 			saved := loadSavedRelay(t)
@@ -978,7 +1014,7 @@ func TestRunRelayJoinTakesADisplayName(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
 	var out bytes.Buffer
-	if err := runRelayJoin(&out, []string{"wss://r.example", "--secret", "s", "--name", "Study Mac Mini"}); err != nil {
+	if err := runRelayJoin(&out, []string{"wss://r.example", "--secret", "s", "--fleet", testFleetSeed, "--name", "Study Mac Mini"}); err != nil {
 		t.Fatalf("runRelayJoin: %v", err)
 	}
 	if saved := loadSavedRelay(t); saved.MachineName != "Study Mac Mini" {
@@ -1000,10 +1036,12 @@ func TestRunRelayJoinRefusesBadArguments(t *testing.T) {
 		{"no url", []string{"--secret", "s"}, "url"},
 		{"no secret", []string{"wss://r.example"}, "--secret"},
 		{"empty secret", []string{"wss://r.example", "--secret", ""}, "--secret"},
-		{"a scheme that is neither", []string{"http://r.example", "--secret", "s"}, "wss://"},
+		{"a scheme that is neither", []string{"http://r.example", "--secret", "s", "--fleet", testFleetSeed}, "wss://"},
 		{"no host", []string{"wss://", "--secret", "s"}, "url"},
-		{"a path on the url", []string{"wss://r.example/daemon", "--secret", "s"}, "path"},
-		{"a name past 64 runes", []string{"wss://r.example", "--secret", "s", "--name", strings.Repeat("é", 65)}, "--name"},
+		{"a path on the url", []string{"wss://r.example/daemon", "--secret", "s", "--fleet", testFleetSeed}, "path"},
+		{"a name past 64 runes", []string{"wss://r.example", "--secret", "s", "--fleet", testFleetSeed, "--name", strings.Repeat("é", 65)}, "--name"},
+		{"no fleet key", []string{"wss://r.example", "--secret", "s"}, "--fleet"},
+		{"a mangled fleet key", []string{"wss://r.example", "--secret", "s", "--fleet", "not-base64url!!"}, "fleet"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Setenv("XDG_CONFIG_HOME", t.TempDir())
@@ -1036,6 +1074,7 @@ func TestRunRelayStatusReportsTheConfiguredRelay(t *testing.T) {
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://flue-relay.karn.workers.dev",
 		Secret:      "s3cret-value",
+		FleetSeed:   testFleetSeed,
 		Origin:      "https://flue-relay.karn.workers.dev",
 		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
 		MachineName: "Karn's MacBook Pro",
@@ -1053,6 +1092,12 @@ func TestRunRelayStatusReportsTheConfiguredRelay(t *testing.T) {
 	if strings.Contains(got, "s3cret-value") {
 		t.Fatalf("status printed the relay secret: %q", got)
 	}
+	// Neither credential, and the fleet key least of all: this line ends up
+	// in terminals, screenshots and bug reports, and the fleet key is the one
+	// that admits devices everywhere.
+	if strings.Contains(got, testFleetSeed) {
+		t.Fatalf("status printed the fleet key: %q", got)
+	}
 }
 
 func TestCmdRelayRejectsAnUnknownSubcommand(t *testing.T) {
diff --git a/cmd/flue/relayui.go b/cmd/flue/relayui.go
index 5496530..2a08348 100644
--- a/cmd/flue/relayui.go
+++ b/cmd/flue/relayui.go
@@ -18,6 +18,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaydeploy"
 	relaybundle "github.com/karnstack/flue/relay"
 )
@@ -151,6 +152,12 @@ func (s *relayUIService) Status(ctx context.Context) daemon.RelayUIStatus {
 		return st
 	}
 	st.Configured = true
+	// The same faults `flue status` names, from the same function, so the
+	// terminal and the screen can never disagree about whether this file is
+	// one the daemon will dial. A relay.json from before the fleet key is the
+	// case that made this necessary: it parses, so Configured is true, and
+	// relay.New refuses it, so the transport never comes up.
+	st.Problems = relayProblems(cfg)
 	st.Origin = cfg.Origin
 	if w, err := updateWorkerName("", cfg); err == nil {
 		st.Worker = w
@@ -339,13 +346,19 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	}
 
 	// The same record `flue relay setup` writes, for the same reasons — see
-	// runRelaySetup for why the id and secret are fresh, why the id is minted
-	// under the fresh secret, and why the write is last.
+	// runRelaySetup for why the id, the secret and the fleet key are fresh,
+	// why the id is minted under the fresh secret, why the fleet key goes
+	// nowhere but this file and the join line, and why the write is last.
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		return daemon.RelayUIDeployResult{}, err
+	}
 	machineID := config.MintMachineID(hostname, secret, rand.Reader)
 	machineName := truncateRunes(hostname, machineNameMaxRunes)
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://" + host,
 		Secret:      secret,
+		FleetSeed:   fleetKey.Seed(),
 		Origin:      "https://" + host,
 		MachineID:   machineID,
 		MachineName: machineName,
@@ -353,7 +366,18 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	}); err != nil {
 		return daemon.RelayUIDeployResult{}, fmt.Errorf("save the relay configuration: %w", err)
 	}
+	steps = append(steps, "fleet key minted (stays on your machines; Cloudflare never sees it)")
 	steps = append(steps, fmt.Sprintf("this machine joined as %s (%s)", machineName, machineID))
+	// Said out loud because the transport this deploy is about to start does
+	// not cover it. daemon.Identity is fixed at construction, so the fleet key
+	// this process signs with is whatever relay.json held when it booted —
+	// nothing, usually, and never the key minted three lines up. The dialling
+	// half picks the new key up immediately (startRelay reads the file), so
+	// this machine verifies its fleet's certs from now; the signing half —
+	// minting a device cert at pairing, a revocation at revoke — waits for a
+	// restart. A user who pairs a phone in between gets a phone that works
+	// here and cannot roam to the machines they add next.
+	steps = append(steps, "restart the daemon to sign with the new fleet key (until then it verifies fleet certs but mints none)")
 
 	if fromRequest {
 		// Stored by product decision — one 0600 file beside relay.json — so
@@ -369,7 +393,7 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	res := daemon.RelayUIDeployResult{
 		Steps:       steps,
 		Origin:      "https://" + host,
-		JoinCommand: joinCommand(host, secret),
+		JoinCommand: joinCommand(host, secret, fleetKey.Seed()),
 	}
 	if started, already := s.runtime.startOnce(); already {
 		// A transport is already up, dialling whatever relay.json said when it
@@ -387,10 +411,15 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	return res, nil
 }
 
-// joinCommand is the one spelling of the hand-off line, shared by the deploy
-// result and the join endpoint so the two can never drift.
-func joinCommand(host, secret string) string {
-	return fmt.Sprintf("flue relay join wss://%s --secret %s", host, secret)
+// joinCommand is the one spelling of the hand-off line, shared by the CLI's
+// setup print, the deploy result and the join endpoint so the three can
+// never drift. It carries the secret and the fleet key seed, which is the
+// line's whole point and its whole weight: docs/RELAY.md says what leaking
+// it now costs where it teaches the line ("Standing one up"), and
+// spec/fleet-trust.md fixes the words — a leaked join line used to buy
+// disruption, and with the fleet key aboard it buys the fleet.
+func joinCommand(host, secret, fleetSeed string) string {
+	return fmt.Sprintf("flue relay join wss://%s --secret %s --fleet %s", host, secret, fleetSeed)
 }
 
 // SetAddress is `flue relay address` behind the card: the user routed a
@@ -445,12 +474,17 @@ func (s *relayUIService) JoinCommand(ctx context.Context) (string, bool, error)
 	if err != nil || !ok {
 		return "", false, err
 	}
-	if cfg.Secret == "" {
-		// A relay.json without a secret cannot join anything.
+	if cfg.Secret == "" || cfg.FleetSeed == "" {
+		// A relay.json without a secret cannot join anything, and one
+		// without a fleet key cannot be joined faithfully: join requires
+		// --fleet, and a line rebuilt without it would be one the command
+		// refuses. A file missing the seed predates the fleet key, and the
+		// path back is re-running setup — which mints one and makes this
+		// answer true again — not a synthesized line.
 		return "", false, nil
 	}
 	host := strings.TrimPrefix(cfg.URL, "wss://")
-	return joinCommand(host, cfg.Secret), true, nil
+	return joinCommand(host, cfg.Secret, cfg.FleetSeed), true, nil
 }
 
 func (s *relayUIService) Update(ctx context.Context, req daemon.RelayUIDeployRequest) (daemon.RelayUIDeployResult, error) {
diff --git a/cmd/flue/relayui_test.go b/cmd/flue/relayui_test.go
index 4b60f4f..c179738 100644
--- a/cmd/flue/relayui_test.go
+++ b/cmd/flue/relayui_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 )
 
 // The service behind the Remote screen is the same deploy the CLI performs,
@@ -59,8 +60,21 @@ func TestRelayUIProvisionDeploysAndStartsTheTransport(t *testing.T) {
 	if cfg.Worker != relayScriptName || cfg.Secret == "" {
 		t.Fatalf("relay.json = %+v; want the default worker and a secret", cfg)
 	}
-	if !strings.Contains(res.JoinCommand, "flue relay join wss://") || !strings.Contains(res.JoinCommand, cfg.Secret) {
-		t.Fatalf("join command %q does not carry the address and the secret", res.JoinCommand)
+	// The fleet key is persisted here or the machines that join off this
+	// deploy have no relay leg at all: relay.New refuses a config without
+	// one, and JoinCommand refuses to spell a line without one. Checked
+	// against fleet.Parse rather than for emptiness so a garbled value is
+	// caught here rather than on the machine it was pasted into.
+	if _, err := fleet.Parse(cfg.FleetSeed); err != nil {
+		t.Fatalf("relay.json fleet_seed = %q, want a key fleet.Parse accepts: %v", cfg.FleetSeed, err)
+	}
+	// Both credentials in the line, because both are what the other machine
+	// needs — the address and the secret alone is the line `flue relay join`
+	// now refuses.
+	if !strings.Contains(res.JoinCommand, "flue relay join wss://") ||
+		!strings.Contains(res.JoinCommand, "--secret "+cfg.Secret) ||
+		!strings.Contains(res.JoinCommand, "--fleet "+cfg.FleetSeed) {
+		t.Fatalf("join command %q does not carry the address, the secret and the fleet key", res.JoinCommand)
 	}
 	// Stored in exactly one place — cloudflare.json — never in relay.json and
 	// never echoed into steps.
@@ -375,6 +389,7 @@ func TestRelayUIJoinCommandRebuildsTheHandOffLine(t *testing.T) {
 		Origin:    "https://flue-relay-dev.karn.workers.dev",
 		MachineID: "m-1",
 		Worker:    "flue-relay-dev",
+		FleetSeed: testFleetSeed,
 	}); err != nil {
 		t.Fatalf("SaveRelay: %v", err)
 	}
@@ -382,11 +397,33 @@ func TestRelayUIJoinCommandRebuildsTheHandOffLine(t *testing.T) {
 	if err != nil || !ok {
 		t.Fatalf("JoinCommand: ok %v err %v", ok, err)
 	}
-	if cmd != "flue relay join wss://flue-relay-dev.karn.workers.dev --secret fleet-s3cret" {
+	if cmd != "flue relay join wss://flue-relay-dev.karn.workers.dev --secret fleet-s3cret --fleet "+testFleetSeed {
 		t.Fatalf("join command = %q", cmd)
 	}
 }
 
+// TestRelayUIJoinCommandStaysQuietWithoutAFleetKey: a relay.json from before
+// the fleet key exists cannot produce a faithful line — join refuses one
+// without --fleet — so the card offers nothing rather than a command that
+// would be refused on the machine it was pasted into.
+func TestRelayUIJoinCommandStaysQuietWithoutAFleetKey(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	svc := &relayUIService{runtime: &relayRuntime{}}
+
+	if err := config.SaveRelay(config.Relay{
+		URL:       "wss://flue-relay-dev.karn.workers.dev",
+		Secret:    "fleet-s3cret",
+		Origin:    "https://flue-relay-dev.karn.workers.dev",
+		MachineID: "m-1",
+		Worker:    "flue-relay-dev",
+	}); err != nil {
+		t.Fatalf("SaveRelay: %v", err)
+	}
+	if cmd, ok, err := svc.JoinCommand(context.Background()); ok || err != nil {
+		t.Fatalf("JoinCommand without a fleet key = %q ok %v err %v; want quiet false", cmd, ok, err)
+	}
+}
+
 func TestRelayAddressRepointsWithoutReminting(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 	f := newFakeCloudflare(t, oneAccount(), "karn")
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index e75039d..bf28727 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -114,9 +114,19 @@ The daemon joins a tunnel like any relay:
 
 ```sh
 XDG_CONFIG_HOME=~/.config/flue-dev go run -tags dev ./cmd/flue relay join \
-  wss://<tunnel-host> --secret <the .dev.vars value>
+  wss://<tunnel-host> --secret <the .dev.vars value> \
+  --fleet "$(head -c 32 /dev/urandom | base64 | tr '+/' '-_' | tr -d '=')"
 ```
 
+`--fleet` is required and this tier never runs `flue relay setup`, so there
+is no printed line to copy one from — mint it yourself, as above. That works
+because the fleet key is just 32 random bytes in unpadded base64url and the
+Worker never holds it ([`spec/fleet-trust.md`](../spec/fleet-trust.md)):
+nothing at the relay has to agree with the value, only the other machines in
+the same dev fleet do. So keep it if you join a second dev machine — two
+machines holding different fleet keys will not honour each other's device
+certificates — and do not paste in the one a real relay printed.
+
 ### 3. A deployed dev relay (using the relay path day to day)
 
 The recommended way to exercise the real thing: deploy a relay into your
diff --git a/docs/RELAY.md b/docs/RELAY.md
index d3e16c2..962dc24 100644
--- a/docs/RELAY.md
+++ b/docs/RELAY.md
@@ -78,8 +78,9 @@ Worker with its Durable Object migration and the whole web bundle as the
 Worker's static assets, served under the same `Referrer-Policy` and
 `Content-Security-Policy` the daemon serves its own UI with, minus the loopback
 sockets a relay origin has no use for, enables the `workers.dev` subdomain, sets a fresh
-32-byte `DAEMON_SECRET` on the script, mints this machine an id and a display
-name, and writes `relay.json` (mode 0600) into flue's config directory,
+32-byte `DAEMON_SECRET` on the script, mints a fresh **fleet key** it uploads
+nowhere, mints this machine an id and a display name, and writes `relay.json`
+(mode 0600) into flue's config directory,
 `$XDG_CONFIG_HOME/flue` or `~/.config/flue`. The API token is never stored:
 its whole life is that one command, and you can delete it afterwards. Restart
 the daemon to pick the relay up.
@@ -87,25 +88,23 @@ the daemon to pick the relay up.
 Setup ends by printing the line every other machine joins with:
 
 ```
-flue relay join wss://flue-relay.<sub>.workers.dev --secret <...>
+flue relay join wss://flue-relay.<sub>.workers.dev --secret <...> --fleet <...>
 ```
 
 Run it there and restart that daemon. That is the whole of adding a machine.
-Join never touches the Cloudflare API: the Worker exists and the secret is the
-whole credential, so everything it does is local, check the address, mint
-this machine a fresh id (`<hostname>-<4 hex>-<8 hex tag>`, its slot on the
-relay and the `<id>` in both wss paths — the tag is a MAC under the secret
-from the join line, which is why an id minted with a mistyped secret dials
-into `404 no such machine`), and write the same `relay.json` shape setup
-writes.
+Join never touches the Cloudflare API — the Worker already exists — so
+everything it does is local: check the address, take the two credentials off
+the line, mint this machine a fresh id (`<hostname>-<4 hex>-<8 hex tag>`, its
+slot on the relay and the `<id>` in both wss paths — the tag is a MAC under
+the secret from the join line, which is why an id minted with a mistyped
+secret dials into `404 no such machine`), and write the same `relay.json`
+shape setup writes. Both flags are required and `--fleet` is refused when
+missing rather than defaulted: a machine that joined without the fleet key
+would dial the relay fine and trust nothing its fleet signed, which is a
+worse failure than not joining.
 `--name` sets the label the machine picker shows; it defaults to the hostname
 and rides the pairing link's query (`n=`) so the pairing browser can write it
-down, never a path, and never anything the Worker routes on. The printed line carries the secret (that is the
-point, it is the deliberate hand-off) so paste it into the other machine's
-terminal, not into a chat that keeps history. Shell history keeps it just as
-well as chat history does (the join line lands in the other machine's history
-file, secret and all) so clear that entry on a machine whose history anyone
-else can read.
+down, never a path, and never anything the Worker routes on.
 
 Run it from a **release binary** (`make build`, or an installed flue). The
 Worker and the web app are both compiled into that binary, and a dev build
@@ -114,13 +113,16 @@ there.
 
 Re-running setup against the same account is safe for the Worker (the deploy
 and the secret are upserts) but it is a reset, not a repair: every run mints
-a fresh secret *and* a fresh machine id. The fresh secret is deliberate:
-setup is the recovery path for a leaked one, and a run that reused the old
-could never rotate it, and it means every machine that joined is now
-presenting a stale secret and has to run the newly printed join line — and,
-because ids carry a MAC tag minted under the secret, every old id stops
+a fresh secret, a fresh fleet key *and* a fresh machine id. The fresh secret
+is deliberate: setup is the recovery path for a leaked one, and a run that
+reused the old could never rotate it, and it means every machine that joined
+is now presenting a stale secret and has to run the newly printed join line —
+and, because ids carry a MAC tag minted under the secret, every old id stops
 routing at the same moment (the re-join each machine runs anyway mints its
-fresh one). The
+fresh one). The fresh fleet key is deliberate for the same reason and cuts
+deeper: it retires every device certificate the old key signed, so no device
+walks into any machine on a cert from before the reset, and every device
+pairs again. The
 fresh id means the old hub slot is simply abandoned: a browser that paired
 against it is dialling a slot no daemon dials, answered `503 daemon offline`
 until it pairs this machine again and forgets the old row in the picker. To
@@ -129,6 +131,40 @@ to run on machine two. Re-running setup against a *different* account leaves
 the old Worker live and reachable; there is no `flue relay teardown`, so
 delete it in the dashboard yourself (`docs/FOLLOW-UPS.md` item 12).
 
+### What the join line is worth
+
+It carries two credentials, and they are not the same kind of thing.
+`--secret` is the `DAEMON_SECRET`, which Cloudflare holds too: it gates the
+daemon leg, so it is exactly as safe as your Cloudflare account. `--fleet` is
+the **fleet key** ([`spec/fleet-trust.md`](../spec/fleet-trust.md)) — the
+private half of one Ed25519 keypair, held by every machine on this relay and
+by nothing else, which signs the certificates that say "this device is one of
+ours". It reaches the Worker in no binding, no secret and no log, and that is
+the entire point: the Worker gates *routing*, the fleet key gates *trust*, and
+the two fail independently. Someone who gets into your Cloudflare account can
+take remote access away; they cannot admit a device.
+
+Which is why the line's weight changed when the fleet key came aboard: **a
+leaked join line used to buy disruption; with the fleet key aboard it buys the
+fleet.** With the secret alone, whoever holds it can squat a machine's slot,
+knock its daemon off, and accept new pairings while pretending to be it
+("One secret for the fleet", below) — bad, and bounded by the ceremony a
+human still has to perform. With the fleet key too, they can sign a device
+certificate for a key they already hold, and every daemon on the relay will
+admit that device as one you paired: no ceremony, no prompt, on machines they
+have never touched.
+
+So treat the printed line as the root credential it is. Paste it into the
+other machine's terminal, not into a chat that keeps history — and shell
+history keeps it just as well as chat history does. The line lands in the
+other machine's history file with the secret *and* the fleet key in it, so
+clear that entry on any machine whose history someone else can read. If it
+does get out, recovery is re-setup: `flue relay setup` mints a fresh secret
+*and* a fresh fleet key, every machine re-joins with the new line, and every
+device pairs again. There is no way to retire one machine's copy of a fleet
+key while keeping the fleet — every machine holds the same key, deliberately
+(that trade is the one that buys pair-once-per-fleet).
+
 ### The Remote screen runs the same deploys
 
 Setup and update are also cards on the UI's Remote screen: a token field, a
@@ -233,6 +269,35 @@ learned by each hub on its first daemon connect) changes no wire format and
 is deliberately deferred; until it lands, this section is the honest statement
 of what the shared secret does and does not separate.
 
+### And one key the Worker never holds
+
+The secret stopped being the only fleet-wide credential when the fleet key
+arrived. The layering, in full:
+
+| credential | held by | what it decides |
+|---|---|---|
+| `DAEMON_SECRET` | every machine, **and Cloudflare** | the daemon leg; which machine ids route |
+| fleet key (private) | every machine, nobody else | signs machine certs, device certs, revocations |
+| fleet key (public) | every machine, every paired device | verifies all three |
+
+That split is what makes "someone got into my Cloudflare account" an
+availability problem rather than a shell on every machine: the Worker can
+refuse to route, and it cannot admit a device, because it holds nothing that
+signs.
+
+The honest cost sits on the other side of the same line. Every machine holds
+the same private key — trust inside the fleet is symmetric, any machine can
+sign for the fleet, and there is no ceremony between machines — so a
+compromised machine can mint a device certificate every other machine will
+honour, and the shared-secret analysis above understates what it can do by
+exactly that much. That is the trade that buys pairing once for a fleet
+instead of once per machine, for the one-operator model this is built for,
+and it is why re-setup (fresh secret, fresh fleet key, everyone re-joins and
+re-pairs) is the whole of compromise recovery. Revoking a *device* is
+per-machine today; making a revocation reach the fleet needs the directory
+that distributes it, which is the next stage of
+[`spec/fleet-trust.md`](../spec/fleet-trust.md).
+
 ## Cost model
 
 The whole free-tier promise rests on this, and it should rest on measured
diff --git a/internal/config/relay.go b/internal/config/relay.go
index 5dee03f..6c6d135 100644
--- a/internal/config/relay.go
+++ b/internal/config/relay.go
@@ -42,6 +42,24 @@ type Relay struct {
 	// (docs/RELAY.md says so where the line is printed).
 	Secret string `json:"secret,omitempty"`
 
+	// FleetSeed is the fleet key's Ed25519 seed, unpadded base64url —
+	// exactly the value `flue relay join --fleet` was given, minted by
+	// `flue relay setup` alongside the secret (spec/fleet-trust.md and
+	// internal/fleet own its meaning; this package only stores the string).
+	// It is the one credential in this file the Worker never holds: the
+	// secret's other copy lives on Cloudflare, the fleet key's copies live
+	// only in the fleet's relay.json files and the join line that carried
+	// it between them. Never logged, never sent anywhere, and the second
+	// reason this file is 0600 — a leaked seed signs device certs every
+	// machine in the fleet honours.
+	//
+	// It rides argv exactly once, beside the secret and for the same
+	// reason: `flue relay join --fleet` is the deliberate hand-off. The
+	// cost is the same shell history, and the consequence is larger, which
+	// is why docs/RELAY.md states it where it teaches the line rather than
+	// leaving it to be inferred from the secret's warning.
+	FleetSeed string `json:"fleet_seed,omitempty"`
+
 	// MachineID is the slot this machine holds on the relay: the <id> in the
 	// /daemon/<id> leg the daemon dials and the /client/<id> URLs browsers
 	// open. Minted by `flue relay setup` and `flue relay join` (MintMachineID),
diff --git a/internal/crypto/devices.go b/internal/crypto/devices.go
index 0484dbe..030eba6 100644
--- a/internal/crypto/devices.go
+++ b/internal/crypto/devices.go
@@ -5,6 +5,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -19,6 +20,15 @@ type Device struct {
 	PublicKey []byte    `json:"publicKey"`
 	PairedAt  time.Time `json:"pairedAt"`
 	LastSeen  time.Time `json:"lastSeen"`
+
+	// Cert is the fleet device certificate for this key — the signed blob
+	// exactly as internal/fleet produces it — when there is one: minted by
+	// this machine's own pairing ceremony, or presented by the device in
+	// its handshake after pairing elsewhere (spec/fleet-trust.md). Opaque
+	// to this package, kept so the machine can hand the cert onward — the
+	// fleet directory will publish it — and empty for devices paired
+	// before the fleet key existed.
+	Cert []byte `json:"cert,omitempty"`
 }
 
 // DeviceID derives the identity from the key itself, so an entry cannot
@@ -60,7 +70,13 @@ func (s *DeviceStore) save(devices []Device) error {
 	if err != nil {
 		return err
 	}
-	tmp, err := os.CreateTemp(filepath.Dir(s.path), "devices.json.*")
+	return s.writeFileLocked(s.path, blob)
+}
+
+// writeFileLocked writes one registry file atomically at 0600. Callers hold
+// s.mu; the name says so.
+func (s *DeviceStore) writeFileLocked(path string, blob []byte) error {
+	tmp, err := os.CreateTemp(filepath.Dir(path), filepath.Base(path)+".*")
 	if err != nil {
 		return err
 	}
@@ -93,7 +109,7 @@ func (s *DeviceStore) save(devices []Device) error {
 	if err := tmp.Close(); err != nil {
 		return err
 	}
-	return os.Rename(tmp.Name(), s.path)
+	return os.Rename(tmp.Name(), path)
 }
 
 func (s *DeviceStore) List() ([]Device, error) {
@@ -102,7 +118,10 @@ func (s *DeviceStore) List() ([]Device, error) {
 	return s.load()
 }
 
-func (s *DeviceStore) Add(label string, publicKey []byte) (Device, error) {
+// Add registers a freshly paired device. cert is its fleet device
+// certificate — nil on a daemon with no fleet key, which pairs exactly as it
+// always did.
+func (s *DeviceStore) Add(label string, publicKey, cert []byte) (Device, error) {
 	if len(publicKey) != 32 {
 		return Device{}, fmt.Errorf("crypto: device key must be 32 bytes, got %d", len(publicKey))
 	}
@@ -123,7 +142,62 @@ func (s *DeviceStore) Add(label string, publicKey []byte) (Device, error) {
 		}
 	}
 	now := time.Now().UTC()
-	d := Device{ID: id, Label: label, PublicKey: slices.Clone(publicKey), PairedAt: now, LastSeen: now}
+	d := Device{ID: id, Label: label, PublicKey: slices.Clone(publicKey), PairedAt: now, LastSeen: now, Cert: slices.Clone(cert)}
+	if err := s.save(append(devices, d)); err != nil {
+		return Device{}, err
+	}
+	return d, nil
+}
+
+// ErrDeviceRevoked is AddFromFleetCert refusing a key on the revocation
+// list. A revocation permanently outranks a device cert for the same key,
+// whatever either one's timestamp says (spec/fleet-trust.md): the check is
+// membership, never a time comparison, and it happens in the same critical
+// section as the add so a concurrent revoke cannot slip between them.
+var ErrDeviceRevoked = errors.New("crypto: this device key is revoked")
+
+// AddFromFleetCert registers a device this machine never paired itself — it
+// arrived with a fleet certificate another machine's ceremony minted — and
+// is what makes the Devices screen show it and LastSeen work.
+//
+// It is idempotent where Add is not: two channels racing the same new
+// device both succeed, the second finding the entry the first wrote. That
+// is the honest semantic — "make sure this certified key is registered" —
+// where Add's is "record the ceremony that just happened", which must never
+// happen twice. An existing entry is returned untouched, label and cert
+// included: the registry is this machine's record, and a reconnect is not
+// an edit.
+//
+// pairedAt is the cert's iat — when the device joined the fleet, which is
+// the fact the column shows — while LastSeen starts now.
+func (s *DeviceStore) AddFromFleetCert(label string, publicKey, cert []byte, pairedAt time.Time) (Device, error) {
+	if len(publicKey) != 32 {
+		return Device{}, fmt.Errorf("crypto: device key must be 32 bytes, got %d", len(publicKey))
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if revoked, err := s.isRevokedLocked(publicKey); err != nil {
+		return Device{}, err
+	} else if revoked {
+		return Device{}, ErrDeviceRevoked
+	}
+	devices, err := s.load()
+	if err != nil {
+		return Device{}, err
+	}
+	for _, d := range devices {
+		if bytes.Equal(d.PublicKey, publicKey) {
+			return d, nil
+		}
+	}
+	d := Device{
+		ID:        DeviceID(publicKey),
+		Label:     label,
+		PublicKey: slices.Clone(publicKey),
+		PairedAt:  pairedAt.UTC(),
+		LastSeen:  time.Now().UTC(),
+		Cert:      slices.Clone(cert),
+	}
 	if err := s.save(append(devices, d)); err != nil {
 		return Device{}, err
 	}
@@ -176,9 +250,61 @@ func (s *DeviceStore) UpdateLastSeen(id string, now time.Time) (bool, error) {
 	return false, nil
 }
 
+// FindByID looks a device up by its display identity — what the revocation
+// path holds — without changing anything.
+func (s *DeviceStore) FindByID(id string) (Device, bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	devices, err := s.load()
+	if err != nil {
+		return Device{}, false, err
+	}
+	for _, d := range devices {
+		if d.ID == id {
+			return d, true, nil
+		}
+	}
+	return Device{}, false, nil
+}
+
+// FindByKey answers the acceptance rule's first question (spec/fleet-trust.md):
+// is this static key one this machine paired, and still paired?
+//
+// A key on the revocation list is never a yes, whatever devices.json still
+// says — and the two questions are one call, under one lock, for the reason
+// AddFromFleetCert checks revocation inside the same critical section as its
+// write. Revoking is two writes in a fixed order (daemon.removeDevice): the
+// signed revocation first, the registry entry second. A revoke that landed
+// the first and failed the second leaves an entry here that must not be
+// honoured, and a caller that asked the two questions separately would have a
+// window between them in which it was.
+//
+// It also simplifies the gossip handler the next stage brings: a revocation
+// arriving from the fleet directory for a device this machine never paired
+// has only to be recorded (AddRevocation), and every acceptance path — this
+// one and AddFromFleetCert both — is already refusing that key. Nothing has
+// to remember to ask a second question.
+//
+// An unreadable revocation list is an error rather than a false, the same
+// direction every other refusal here takes: a caller deciding whether to
+// admit a key must refuse when it cannot know.
+//
+// One edge this leaves standing, deliberately and not comfortably: Add does
+// not consult the revocation list, so re-pairing a revoked *key* — which the
+// browser does whenever its IndexedDB survives the revoke, since it reuses
+// its device key — writes an entry this function will then refuse. The
+// ceremony reports success and the relay channel closes anyway. Making Add
+// refuse, or making a deliberate re-pairing clear the revocation, is a
+// design call about what "un-revoking" means (the spec says: a new key, and
+// the old one stays dead) and is deliberately not decided here.
 func (s *DeviceStore) FindByKey(publicKey []byte) (Device, bool, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if revoked, err := s.isRevokedLocked(publicKey); err != nil {
+		return Device{}, false, err
+	} else if revoked {
+		return Device{}, false, nil
+	}
 	devices, err := s.load()
 	if err != nil {
 		return Device{}, false, err
@@ -198,3 +324,108 @@ func (s *DeviceStore) FindByKey(publicKey []byte) (Device, bool, error) {
 	}
 	return Device{}, false, nil
 }
+
+// --- the revocation set ---
+
+// Revocations live in revocations.json beside devices.json, under the same
+// lock, because the two are one fact with two signs: a device is paired, or
+// its key is dead. Removing an entry from devices.json stopped being a
+// complete revocation the day fleet certs existed — the cert would walk the
+// device straight back in through AddFromFleetCert — so the revocation is
+// recorded here, permanently. Un-revoking is pairing again under a fresh
+// key (spec/fleet-trust.md); nothing ever deletes from this file.
+//
+// Each entry keeps the signed revocation blob the fleet key produced, so
+// the record that refuses the key locally is the same artifact the fleet
+// directory will publish to every other machine.
+
+// revocationsFileName is the set's file, 0600 like devices.json — not
+// because revocations are secret (they are signed, public artifacts) but
+// because one loose mode in this directory would be one to explain.
+const revocationsFileName = "revocations.json"
+
+// StoredRevocation is one dead key: the key itself, and the signed
+// fleet revocation for it.
+type StoredRevocation struct {
+	PublicKey []byte `json:"publicKey"`
+	Cert      []byte `json:"cert"`
+}
+
+func (s *DeviceStore) revocationsPath() string {
+	return filepath.Join(filepath.Dir(s.path), revocationsFileName)
+}
+
+func (s *DeviceStore) loadRevocations() ([]StoredRevocation, error) {
+	raw, err := os.ReadFile(s.revocationsPath())
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var out []StoredRevocation
+	if err := json.Unmarshal(raw, &out); err != nil {
+		return nil, fmt.Errorf("crypto: %s is not a revocation list: %w", s.revocationsPath(), err)
+	}
+	return out, nil
+}
+
+func (s *DeviceStore) isRevokedLocked(publicKey []byte) (bool, error) {
+	revs, err := s.loadRevocations()
+	if err != nil {
+		return false, err
+	}
+	for _, r := range revs {
+		if bytes.Equal(r.PublicKey, publicKey) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// IsRevoked reports whether publicKey is on the revocation list. An
+// unreadable list is an error, not a false: the caller deciding whether to
+// admit a key must refuse when it cannot know, the same direction FindByKey
+// errors push.
+func (s *DeviceStore) IsRevoked(publicKey []byte) (bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.isRevokedLocked(publicKey)
+}
+
+// AddRevocation records a dead key with its signed revocation. Idempotent
+// by key — revoking twice, or hearing the same revocation again from the
+// directory one stage on, is one entry — and the first blob recorded wins,
+// which is safe because any verifying revocation for a key is exactly as
+// dead as any other.
+func (s *DeviceStore) AddRevocation(publicKey, cert []byte) error {
+	if len(publicKey) != 32 {
+		return fmt.Errorf("crypto: device key must be 32 bytes, got %d", len(publicKey))
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	revs, err := s.loadRevocations()
+	if err != nil {
+		return err
+	}
+	for _, r := range revs {
+		if bytes.Equal(r.PublicKey, publicKey) {
+			return nil
+		}
+	}
+	revs = append(revs, StoredRevocation{PublicKey: slices.Clone(publicKey), Cert: slices.Clone(cert)})
+	blob, err := json.MarshalIndent(revs, "", "  ")
+	if err != nil {
+		return err
+	}
+	return s.writeFileLocked(s.revocationsPath(), blob)
+}
+
+// Revocations is the whole set — what the directory publisher one stage on
+// pushes for the machines that were not in the room when the revoke
+// happened.
+func (s *DeviceStore) Revocations() ([]StoredRevocation, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.loadRevocations()
+}
diff --git a/internal/crypto/devices_test.go b/internal/crypto/devices_test.go
index c33747e..9e14d5e 100644
--- a/internal/crypto/devices_test.go
+++ b/internal/crypto/devices_test.go
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"slices"
@@ -52,7 +53,7 @@ func TestDeviceStoreRoundTrip(t *testing.T) {
 	s := NewDeviceStore(dir)
 
 	key := testKey(t)
-	d, err := s.Add("karn's phone", key)
+	d, err := s.Add("karn's phone", key, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -83,14 +84,14 @@ func TestDeviceStoreRoundTrip(t *testing.T) {
 
 func TestDeviceStoreRejectsBadAndDuplicateKeys(t *testing.T) {
 	s := NewDeviceStore(t.TempDir())
-	if _, err := s.Add("short", []byte{1, 2, 3}); err == nil {
+	if _, err := s.Add("short", []byte{1, 2, 3}, nil); err == nil {
 		t.Fatal("accepted a non-32-byte key")
 	}
 	key := testKey(t)
-	if _, err := s.Add("first", key); err != nil {
+	if _, err := s.Add("first", key, nil); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := s.Add("second", key); err == nil {
+	if _, err := s.Add("second", key, nil); err == nil {
 		t.Fatal("accepted the same key twice")
 	}
 }
@@ -168,7 +169,7 @@ func TestAddDecidesDuplicatesOnTheWholeKey(t *testing.T) {
 	fresh := testKey(t)
 	writeRegistry(t, dir, []Device{planted(DeviceID(fresh), paired)})
 
-	d, err := s.Add("second phone", fresh)
+	d, err := s.Add("second phone", fresh, nil)
 	if err != nil {
 		t.Fatalf("Add refused a key the registry does not hold: %v", err)
 	}
@@ -177,7 +178,7 @@ func TestAddDecidesDuplicatesOnTheWholeKey(t *testing.T) {
 	}
 
 	// The true duplicate is still refused, on the bytes.
-	if _, err := s.Add("again", fresh); err == nil {
+	if _, err := s.Add("again", fresh, nil); err == nil {
 		t.Fatal("Add accepted the same key twice")
 	}
 }
@@ -187,7 +188,7 @@ func TestAddDecidesDuplicatesOnTheWholeKey(t *testing.T) {
 // a connection may be stamping itself at the moment it is revoked.
 func TestUpdateLastSeen(t *testing.T) {
 	s := NewDeviceStore(t.TempDir())
-	dev, err := s.Add("phone", testKey(t))
+	dev, err := s.Add("phone", testKey(t), nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -218,9 +219,148 @@ func TestUpdateLastSeen(t *testing.T) {
 	}
 }
 
+// TestAddFromFleetCert: the fleet-admission write is idempotent — two
+// channels racing the same new device both succeed on one entry — and the
+// entry carries the cert, the cert's pairing time, and a fresh LastSeen.
+func TestAddFromFleetCert(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	key := testKey(t)
+	cert := []byte("a signed blob, opaque to this package")
+	pairedAt := time.Now().Add(-24 * time.Hour).Truncate(time.Second)
+
+	d, err := s.AddFromFleetCert("attic phone", key, cert, pairedAt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Label != "attic phone" || !bytes.Equal(d.Cert, cert) || !d.PairedAt.Equal(pairedAt) {
+		t.Fatalf("admitted device = %+v", d)
+	}
+	if !d.LastSeen.After(pairedAt) {
+		t.Fatalf("LastSeen = %v, want now rather than the cert's iat", d.LastSeen)
+	}
+
+	// Again, with a different label: the existing entry wins, untouched.
+	again, err := s.AddFromFleetCert("someone renamed it", key, []byte("another blob"), time.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again.Label != "attic phone" || !bytes.Equal(again.Cert, cert) {
+		t.Fatalf("a second admission rewrote the entry: %+v", again)
+	}
+	if list, _ := s.List(); len(list) != 1 {
+		t.Fatalf("registry holds %d entries, want 1", len(list))
+	}
+}
+
+// TestRevocationOutranksTheCert is the spec's precedence rule at the store:
+// a revoked key is refused by AddFromFleetCert however fresh the cert that
+// presents it, because the check is set membership and never a timestamp.
+func TestRevocationOutranksTheCert(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	key := testKey(t)
+
+	if err := s.AddRevocation(key, []byte("signed revocation")); err != nil {
+		t.Fatal(err)
+	}
+	if revoked, err := s.IsRevoked(key); err != nil || !revoked {
+		t.Fatalf("IsRevoked = %v, %v", revoked, err)
+	}
+	if _, err := s.AddFromFleetCert("it's back", key, []byte("a newer cert"), time.Now()); !errors.Is(err, ErrDeviceRevoked) {
+		t.Fatalf("AddFromFleetCert on a revoked key = %v, want ErrDeviceRevoked", err)
+	}
+	if list, _ := s.List(); len(list) != 0 {
+		t.Fatalf("the revoked key reached the registry: %+v", list)
+	}
+
+	// A different key is unaffected, and Add — this machine's own ceremony —
+	// deliberately is too: rule 1 of the acceptance order is "pairing on this
+	// machine works as before". What that leaves is not free, and the old
+	// note here claimed otherwise ("a fresh ceremony mints a fresh key
+	// anyway" — it does not; web/src/crypto/keys.ts reuses the key in
+	// IndexedDB across pairings). So an operator who revokes a device and
+	// then re-pairs the same browser gets an entry FindByKey refuses: paired
+	// on the screen, closed on the wire. Deciding that — Add refusing, or a
+	// deliberate re-pairing clearing the revocation — is a design call about
+	// what un-revoking means, and it is open.
+	other := testKey(t)
+	if revoked, err := s.IsRevoked(other); err != nil || revoked {
+		t.Fatalf("IsRevoked(other) = %v, %v", revoked, err)
+	}
+
+	// Recording the same key again is one entry, and the set survives a
+	// fresh store over the same directory.
+	if err := s.AddRevocation(key, []byte("recorded twice")); err != nil {
+		t.Fatal(err)
+	}
+	revs, err := NewDeviceStore(filepath.Dir(s.revocationsPath())).Revocations()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(revs) != 1 || !bytes.Equal(revs[0].PublicKey, key) || string(revs[0].Cert) != "signed revocation" {
+		t.Fatalf("revocations = %+v, want the one original entry", revs)
+	}
+}
+
+// TestFindByKeyRefusesARevokedKey: the store's answer to "is this key one we
+// paired" has to account for the revocation list, because the two files are
+// written in a fixed order and the window between them is real. Revoking
+// records the signed revocation first and removes the registry entry second
+// (daemon.removeDevice), on the grounds that the first write is what kills
+// the key — and that only holds if every acceptance path reads it.
+//
+// The error direction matters as much as the answer: an unreadable
+// revocation list is a refusal, not a shrug, because a caller that cannot
+// know must not admit.
+func TestFindByKeyRefusesARevokedKey(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	key := testKey(t)
+	d, err := s.Add("phone", key, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, err := s.FindByKey(key); err != nil || !ok {
+		t.Fatalf("FindByKey before the revoke = %v, %v", ok, err)
+	}
+
+	// Exactly the state a revoke leaves when its second write fails: the
+	// revocation is on file and the entry is still listed.
+	if err := s.AddRevocation(key, []byte("signed revocation")); err != nil {
+		t.Fatal(err)
+	}
+	if list, _ := s.List(); len(list) != 1 || list[0].ID != d.ID {
+		t.Fatalf("registry = %+v; this test needs the entry still there", list)
+	}
+	if got, ok, err := s.FindByKey(key); err != nil || ok {
+		t.Fatalf("FindByKey on a revoked but still-listed key = %+v, %v, %v; want no match", got, ok, err)
+	}
+
+	// An unreadable list refuses rather than falls back to the registry.
+	if err := os.WriteFile(s.revocationsPath(), []byte("{not a list"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, err := s.FindByKey(key); err == nil || ok {
+		t.Fatalf("FindByKey with an unreadable revocation list = %v, %v; want an error and no match", ok, err)
+	}
+}
+
+func TestFindByID(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	d, err := s.Add("phone", testKey(t), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok, err := s.FindByID(d.ID)
+	if err != nil || !ok || got.ID != d.ID {
+		t.Fatalf("FindByID = %+v, %v, %v", got, ok, err)
+	}
+	if _, ok, err := s.FindByID("000000000000"); err != nil || ok {
+		t.Fatalf("FindByID of an unknown id = %v, %v, want false and no error", ok, err)
+	}
+}
+
 func TestDeviceStoreRemove(t *testing.T) {
 	s := NewDeviceStore(t.TempDir())
-	d, err := s.Add("phone", testKey(t))
+	d, err := s.Add("phone", testKey(t), nil)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/crypto/handshake.go b/internal/crypto/handshake.go
index f0ad5a7..a9957cf 100644
--- a/internal/crypto/handshake.go
+++ b/internal/crypto/handshake.go
@@ -11,14 +11,31 @@ import (
 // IK, message by message:
 //   <- s            (pre-message: the initiator knows the daemon's static key
 //                    from the pairing QR — that is the pinning)
-//   -> e, es, s, ss
+//   -> e, es, s, ss [payload]
 //   <- e, ee, se
 // Two messages, then both sides hold a pair of CipherStates.
+//
+// Message A's payload is encrypted — under keys mixed from es and ss, so
+// only the pinned responder can read it and only a sender holding the static
+// key it announces could have sealed it — and it is where the initiator
+// presents its fleet device certificate (spec/fleet-trust.md): empty means
+// none, anything else must be exactly one signed cert blob. The payload is
+// carried and returned here verbatim; judging it is the transport's job
+// (internal/transport/relay/channel.go), because "no cert" is a fine
+// handshake and only the acceptance rule knows whether it is a fine client.
+//
+// One honest caveat the acceptance rule lives with: message A, bytes and
+// payload, can be replayed by an observer. A replayer cannot finish the
+// session — it never learns the ephemeral behind e — so what a replay buys
+// is re-presenting a cert that was already presented, which re-admits a key
+// that was already admitted: idempotent, and revocation is checked on every
+// presentation.
 
-// InitiatorHandshake runs the browser side of the handshake. It exists in Go
-// for tests and the vector generator; production initiators are TypeScript.
-// rng == nil means crypto/rand.
-func InitiatorHandshake(static noise.DHKey, peerStatic []byte, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, error) {
+// InitiatorHandshake runs the browser side of the handshake, sending payload
+// in message A (nil for none). It exists in Go for tests and the vector
+// generator; production initiators are TypeScript. rng == nil means
+// crypto/rand.
+func InitiatorHandshake(static noise.DHKey, peerStatic []byte, payload []byte, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, error) {
 	if rng == nil {
 		rng = rand.Reader
 	}
@@ -33,7 +50,7 @@ func InitiatorHandshake(static noise.DHKey, peerStatic []byte, rng io.Reader, re
 	if err != nil {
 		return nil, err
 	}
-	msg1, _, _, err := hs.WriteMessage(nil, nil)
+	msg1, _, _, err := hs.WriteMessage(nil, payload)
 	if err != nil {
 		return nil, fmt.Errorf("crypto: handshake message 1: %w", err)
 	}
@@ -55,9 +72,10 @@ func InitiatorHandshake(static noise.DHKey, peerStatic []byte, rng io.Reader, re
 
 // ResponderHandshake runs the daemon side. The returned public key is the
 // initiator's static — the device identity the caller authorizes against the
-// device store. Callers must treat an error as fatal to the connection and
-// process no frames before the handshake completes.
-func ResponderHandshake(static noise.DHKey, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, []byte, error) {
+// device store — and payload is message A's decrypted payload, empty when
+// the initiator sent none. Callers must treat an error as fatal to the
+// connection and process no frames before the handshake completes.
+func ResponderHandshake(static noise.DHKey, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, []byte, []byte, error) {
 	if rng == nil {
 		rng = rand.Reader
 	}
@@ -69,21 +87,22 @@ func ResponderHandshake(static noise.DHKey, rng io.Reader, recv func() ([]byte,
 		Random:        rng,
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	msg1, err := recv()
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
-	if _, _, _, err := hs.ReadMessage(nil, msg1); err != nil {
-		return nil, nil, fmt.Errorf("crypto: handshake message 1: %w", err)
+	payload, _, _, err := hs.ReadMessage(nil, msg1)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("crypto: handshake message 1: %w", err)
 	}
 	msg2, csI2R, csR2I, err := hs.WriteMessage(nil, nil)
 	if err != nil {
-		return nil, nil, fmt.Errorf("crypto: handshake message 2: %w", err)
+		return nil, nil, nil, fmt.Errorf("crypto: handshake message 2: %w", err)
 	}
 	if err := send(msg2); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
-	return &Channel{send: csR2I, recv: csI2R}, hs.PeerStatic(), nil
+	return &Channel{send: csR2I, recv: csI2R}, hs.PeerStatic(), payload, nil
 }
diff --git a/internal/crypto/handshake_test.go b/internal/crypto/handshake_test.go
index 8d79997..9d3af0a 100644
--- a/internal/crypto/handshake_test.go
+++ b/internal/crypto/handshake_test.go
@@ -19,6 +19,14 @@ func (p *pipe) bSend(b []byte) error   { p.b2a <- b; return nil }
 func (p *pipe) bRecv() ([]byte, error) { return <-p.a2b, nil }
 
 func handshakePair(t *testing.T) (initiator, responder *Channel, deviceStatic []byte) {
+	i, r, static, payload := handshakePairWithPayload(t, nil)
+	if len(payload) != 0 {
+		t.Fatalf("an initiator that sent no payload delivered %d bytes of one", len(payload))
+	}
+	return i, r, static
+}
+
+func handshakePairWithPayload(t *testing.T, payload []byte) (initiator, responder *Channel, deviceStatic, gotPayload []byte) {
 	t.Helper()
 	daemonKey, err := Suite().GenerateKeypair(rand.Reader)
 	if err != nil {
@@ -30,16 +38,17 @@ func handshakePair(t *testing.T) (initiator, responder *Channel, deviceStatic []
 	}
 	p := newPipe()
 	type res struct {
-		ch   *Channel
-		peer []byte
-		err  error
+		ch      *Channel
+		peer    []byte
+		payload []byte
+		err     error
 	}
 	done := make(chan res, 1)
 	go func() {
-		ch, peer, err := ResponderHandshake(daemonKey, nil, p.bRecv, p.bSend)
-		done <- res{ch, peer, err}
+		ch, peer, pl, err := ResponderHandshake(daemonKey, nil, p.bRecv, p.bSend)
+		done <- res{ch, peer, pl, err}
 	}()
-	ich, err := InitiatorHandshake(deviceKey, daemonKey.Public, nil, p.aRecv, p.aSend)
+	ich, err := InitiatorHandshake(deviceKey, daemonKey.Public, payload, nil, p.aRecv, p.aSend)
 	if err != nil {
 		t.Fatalf("initiator: %v", err)
 	}
@@ -50,7 +59,25 @@ func handshakePair(t *testing.T) (initiator, responder *Channel, deviceStatic []
 	if !bytes.Equal(r.peer, deviceKey.Public) {
 		t.Fatal("responder saw the wrong initiator static key")
 	}
-	return ich, r.ch, deviceKey.Public
+	return ich, r.ch, deviceKey.Public, r.payload
+}
+
+// TestHandshakePayloadRoundTrips: message A's encrypted payload — where the
+// fleet device cert rides (spec/fleet-trust.md) — reaches the responder byte
+// for byte, and the channel that follows works exactly as one without it.
+func TestHandshakePayloadRoundTrips(t *testing.T) {
+	want := []byte("an opaque cert blob, as far as this layer knows")
+	i, r, _, payload := handshakePairWithPayload(t, want)
+	if !bytes.Equal(payload, want) {
+		t.Fatalf("responder read payload %q, want %q", payload, want)
+	}
+	ct, err := i.Seal([]byte("after the payload"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pt, err := r.Open(ct); err != nil || string(pt) != "after the payload" {
+		t.Fatalf("transport after a payload handshake: %q, %v", pt, err)
+	}
 }
 
 func TestHandshakeAndBothDirections(t *testing.T) {
@@ -117,12 +144,12 @@ func TestWrongPinnedStaticKeyFailsTheHandshake(t *testing.T) {
 
 	errCh := make(chan error, 1)
 	go func() {
-		_, _, err := ResponderHandshake(daemonKey, nil, recvWithTimeout(p.bRecv), sendWithTimeout(p.bSend))
+		_, _, _, err := ResponderHandshake(daemonKey, nil, recvWithTimeout(p.bRecv), sendWithTimeout(p.bSend))
 		errCh <- err
 	}()
 	// The initiator pins the imposter's key; IK's first message encrypts to
 	// the pinned key, so the real daemon must fail to read it.
-	if _, err := InitiatorHandshake(deviceKey, imposter.Public, nil, recvWithTimeout(p.aRecv), sendWithTimeout(p.aSend)); err == nil {
+	if _, err := InitiatorHandshake(deviceKey, imposter.Public, nil, nil, recvWithTimeout(p.aRecv), sendWithTimeout(p.aSend)); err == nil {
 		// The initiator may or may not detect it first depending on where
 		// decryption fails; the responder must.
 		if err := <-errCh; err == nil {
diff --git a/internal/crypto/vectors_test.go b/internal/crypto/vectors_test.go
index 3bbe4e5..f1b40f4 100644
--- a/internal/crypto/vectors_test.go
+++ b/internal/crypto/vectors_test.go
@@ -60,16 +60,70 @@ type vectorMessage struct {
 
 const vectorPath = "../../testdata/noise/ik.json"
 
+// payloadVectorPath is ik.json's sibling with a certificate riding message
+// A's encrypted payload: the same protocol, the same deterministic statics
+// and ephemerals, and one new field — msg1Payload, the fleet device cert
+// blob out of testdata/fleet/certs.json, verbatim. ik.json itself is
+// deliberately untouched (its msg1 carries the empty payload every
+// pre-fleet initiator sends, and the TS suites replay it as committed);
+// this file is what pins the payload-bearing shape for the TS initiator
+// that will send one. Regenerate testdata/fleet/certs.json first — this
+// file embeds its bytes.
+const payloadVectorPath = "../../testdata/noise/ik-payload.json"
+
+// fleetCertsPath is where the payload bytes come from. Read as data, not
+// imported: the cert blob is opaque to this layer, which is the point.
+const fleetCertsPath = "../../testdata/fleet/certs.json"
+
+type payloadVectorFile struct {
+	vectorFile
+	// Msg1Payload is the plaintext the initiator sealed into message A —
+	// hex, like every other byte string here. It equals the "device" case's
+	// signedHex in testdata/fleet/certs.json, and the assertion run checks
+	// that too, so the two fixtures cannot drift apart.
+	Msg1Payload string `json:"msg1Payload"`
+}
+
+// fixtureDeviceCert reads the signed device-cert blob the payload vectors
+// carry.
+func fixtureDeviceCert(t *testing.T) []byte {
+	t.Helper()
+	raw, err := os.ReadFile(fleetCertsPath)
+	if err != nil {
+		t.Fatalf("reading %s (generate with `go test ./internal/fleet/ -update`): %v", fleetCertsPath, err)
+	}
+	var f struct {
+		Cases []struct {
+			Name      string `json:"name"`
+			SignedHex string `json:"signedHex"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(raw, &f); err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range f.Cases {
+		if c.Name == "device" {
+			b, err := hex.DecodeString(c.SignedHex)
+			if err != nil {
+				t.Fatal(err)
+			}
+			return b
+		}
+	}
+	t.Fatalf("%s carries no \"device\" case", fleetCertsPath)
+	return nil
+}
+
 // capture records every frame either side sends, while still delivering it.
 type capture struct {
 	pipe *pipe
 	msgs [][]byte
 }
 
-func TestGenerateVectors(t *testing.T) {
-	if !*update {
-		t.Skip("run with -update to regenerate")
-	}
+// generateVectors runs one deterministic handshake — msg-A payload included,
+// nil for none — and returns everything a replay needs.
+func generateVectors(t *testing.T, payload []byte) vectorFile {
+	t.Helper()
 	// Static keys from their own deterministic streams; ephemerals from the
 	// streams handed to the handshakes. GenerateKeypair reads exactly 32
 	// bytes, so the ephemeral private key is the first 32 bytes of that
@@ -99,12 +153,12 @@ func TestGenerateVectors(t *testing.T) {
 	}
 	done := make(chan rres, 1)
 	go func() {
-		ch, _, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
+		ch, _, _, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
 			func() ([]byte, error) { b := <-p.a2b; msg1 = b; return b, nil },
 			func(b []byte) error { msg2 = b; p.b2a <- b; return nil })
 		done <- rres{ch, err}
 	}()
-	iCh, err := InitiatorHandshake(iStatic, rStatic.Public, &detReader{label: []byte("initiator-ephemeral")}, p.aRecv, p.aSend)
+	iCh, err := InitiatorHandshake(iStatic, rStatic.Public, payload, &detReader{label: []byte("initiator-ephemeral")}, p.aRecv, p.aSend)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -128,7 +182,7 @@ func TestGenerateVectors(t *testing.T) {
 	seal("r2i", r.ch, iCh, []byte("hello browser"))
 	seal("i2r", iCh, r.ch, nil)
 
-	out, err := json.MarshalIndent(vectorFile{
+	return vectorFile{
 		Protocol:               "Noise_IK_25519_ChaChaPoly_SHA256",
 		InitiatorStaticPriv:    hex.EncodeToString(iStatic.Private),
 		InitiatorStaticPub:     hex.EncodeToString(iStatic.Public),
@@ -139,27 +193,39 @@ func TestGenerateVectors(t *testing.T) {
 		Msg1:                   hex.EncodeToString(msg1),
 		Msg2:                   hex.EncodeToString(msg2),
 		Transport:              transport,
-	}, "", "  ")
+	}
+}
+
+func writeVectorFile(t *testing.T, path string, v any) {
+	t.Helper()
+	out, err := json.MarshalIndent(v, "", "  ")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := os.MkdirAll(filepath.Dir(vectorPath), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(vectorPath, append(out, '\n'), 0o644); err != nil {
+	if err := os.WriteFile(path, append(out, '\n'), 0o644); err != nil {
 		t.Fatal(err)
 	}
 }
 
-func TestVectorsAgainstDisk(t *testing.T) {
-	raw, err := os.ReadFile(vectorPath)
-	if err != nil {
-		t.Fatalf("read vectors (generate with -update): %v", err)
-	}
-	var v vectorFile
-	if err := json.Unmarshal(raw, &v); err != nil {
-		t.Fatal(err)
+func TestGenerateVectors(t *testing.T) {
+	if !*update {
+		t.Skip("run with -update to regenerate")
 	}
+	writeVectorFile(t, vectorPath, generateVectors(t, nil))
+
+	cert := fixtureDeviceCert(t)
+	pv := payloadVectorFile{vectorFile: generateVectors(t, cert), Msg1Payload: hex.EncodeToString(cert)}
+	writeVectorFile(t, payloadVectorPath, pv)
+}
+
+// replayVectorFile replays the responder side against the recorded msg1,
+// asserts every byte it produces matches the file, and returns the msg-A
+// payload the responder read.
+func replayVectorFile(t *testing.T, path string, v vectorFile) []byte {
+	t.Helper()
 	unhex := func(s string) []byte {
 		b, err := hex.DecodeString(s)
 		if err != nil {
@@ -168,36 +234,78 @@ func TestVectorsAgainstDisk(t *testing.T) {
 		return b
 	}
 
-	// Replay the responder side against the recorded msg1 and assert every
-	// byte it produces matches the file.
 	rStatic := noiseKey(unhex(v.ResponderStaticPriv), unhex(v.ResponderStaticPub))
 	var gotMsg2 []byte
-	ch, peer, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
+	ch, peer, payload, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
 		func() ([]byte, error) { return unhex(v.Msg1), nil },
 		func(b []byte) error { gotMsg2 = b; return nil })
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !bytes.Equal(gotMsg2, unhex(v.Msg2)) {
-		t.Fatal("responder produced a different msg2 than the vector file")
+		t.Fatalf("%s: responder produced a different msg2 than the vector file", path)
 	}
 	if !bytes.Equal(peer, unhex(v.InitiatorStaticPub)) {
-		t.Fatal("responder resolved a different initiator identity")
+		t.Fatalf("%s: responder resolved a different initiator identity", path)
 	}
 	for _, m := range v.Transport {
 		switch m.Dir {
 		case "i2r":
 			pt, err := ch.Open(unhex(m.Ciphertext))
 			if err != nil || !bytes.Equal(pt, unhex(m.Plaintext)) {
-				t.Fatalf("i2r transport message: %v", err)
+				t.Fatalf("%s: i2r transport message: %v", path, err)
 			}
 		case "r2i":
 			ct, err := ch.Seal(unhex(m.Plaintext))
 			if err != nil || !bytes.Equal(ct, unhex(m.Ciphertext)) {
-				t.Fatalf("r2i transport message: %v", err)
+				t.Fatalf("%s: r2i transport message: %v", path, err)
 			}
 		}
 	}
+	return payload
+}
+
+func TestVectorsAgainstDisk(t *testing.T) {
+	raw, err := os.ReadFile(vectorPath)
+	if err != nil {
+		t.Fatalf("read vectors (generate with -update): %v", err)
+	}
+	var v vectorFile
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatal(err)
+	}
+	// ik.json's msg1 is the payload-less handshake every pre-fleet initiator
+	// sends, and it must stay that: the TS suites replay these bytes as the
+	// ordinary client.
+	if payload := replayVectorFile(t, vectorPath, v); len(payload) != 0 {
+		t.Fatalf("ik.json's msg1 carries a %d-byte payload, want none", len(payload))
+	}
+}
+
+// TestPayloadVectorsAgainstDisk replays ik-payload.json — message A carrying
+// the fleet device cert — and holds it to testdata/fleet/certs.json: the
+// payload the responder reads must be the "device" case's signed blob,
+// byte for byte, so the two fixtures cannot drift apart.
+func TestPayloadVectorsAgainstDisk(t *testing.T) {
+	raw, err := os.ReadFile(payloadVectorPath)
+	if err != nil {
+		t.Fatalf("read vectors (generate with -update): %v", err)
+	}
+	var v payloadVectorFile
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatal(err)
+	}
+	payload := replayVectorFile(t, payloadVectorPath, v.vectorFile)
+	want, err := hex.DecodeString(v.Msg1Payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(payload, want) {
+		t.Fatal("the responder read a different msg1 payload than the file records")
+	}
+	if cert := fixtureDeviceCert(t); !bytes.Equal(payload, cert) {
+		t.Fatal("ik-payload.json's payload is not testdata/fleet/certs.json's device blob; regenerate certs.json first, then these vectors")
+	}
 }
 
 func noiseKey(priv, pub []byte) noise.DHKey { return noise.DHKey{Private: priv, Public: pub} }
diff --git a/internal/daemon/pairing.go b/internal/daemon/pairing.go
index aad67ad..5b4bbd8 100644
--- a/internal/daemon/pairing.go
+++ b/internal/daemon/pairing.go
@@ -12,6 +12,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/karnstack/flue/internal/fleet"
 )
 
 // PairPath is the second of the two routes that may be reached by a method
@@ -343,7 +345,55 @@ func (s *Server) PairDevice(body []byte, peer string) PairOutcome {
 		return s.refusePair(peer, res.String())
 	}
 
-	dev, err := s.identity.Devices.Add(deviceLabel(req.Label), key)
+	label := DeviceLabel(req.Label)
+
+	// The ceremony that just completed is the moment the spec mints the fleet
+	// device cert (spec/fleet-trust.md, Certificates): this machine signs
+	// {device key, name, this machine's id, now} under the fleet key, and the
+	// registry entry carries the blob. Today the cert is what lets this
+	// device into every daemon that holds the fleet public key — it presents
+	// the blob in its handshake — and the stored copy is what the fleet
+	// directory will publish once that stage lands.
+	//
+	// A daemon without a fleet key mints nothing and pairs exactly as it
+	// always did. A signing failure is treated the same way, minus a log
+	// line: it is unreachable short of a corrupt key (the fields here are
+	// already validated), and refusing the user's ceremony over the cert
+	// would take working local pairing away to protect a convenience.
+	//
+	// So is a daemon that cannot name itself. `pairedOn` is a machine id in
+	// the spec, and the directory the next stage brings keys certs by it: a
+	// cert claiming the empty machine is one nothing can attribute and no
+	// reader can line up against the machine certs beside it. Rather than
+	// sign that, this mints nothing — the honest half of a half-configured
+	// relay.
+	//
+	// The state is reachable, narrowly: relayMachine's id is set by whoever
+	// starts the transport, and only once relay.New has accepted the config,
+	// so a relay.json carrying a fleet seed but missing (say) a machine id
+	// leaves this daemon holding a fleet key and no place on the relay. Such
+	// a machine is not on the relay at all, so a device paired here could not
+	// have reached a sibling on this cert's strength anyway: what the refusal
+	// costs is nothing the device had. `flue status` names the missing field;
+	// fixing it, restarting, and pairing again mints the cert.
+	var cert []byte
+	if s.identity.Fleet.Valid() {
+		if pairedOn := s.relayMachine().id; pairedOn == "" {
+			s.logger().Warn("not minting a fleet device cert: this daemon holds a fleet key but has no machine id on the relay; the device is paired to this machine only",
+				"peer", peer)
+		} else if blob, err := s.identity.Fleet.Sign(fleet.DeviceCert{
+			Device:   key,
+			Name:     label,
+			PairedOn: pairedOn,
+			IAT:      time.Now().Unix(),
+		}); err != nil {
+			s.logger().Error("could not mint a fleet device cert; the device is paired to this machine only", "err", err)
+		} else {
+			cert = blob
+		}
+	}
+
+	dev, err := s.identity.Devices.Add(label, key, cert)
 	if err != nil {
 		// The window is already spent, so this is not a retry loop the caller
 		// can drive; it is a device that was already paired, or a registry
@@ -468,10 +518,19 @@ func (s *Server) handlePair(w http.ResponseWriter, r *http.Request) {
 	s.writePairOutcome(w, s.PairDevice(body, r.RemoteAddr))
 }
 
-// deviceLabel normalises the device's self-chosen name: trimmed, bounded, and
+// DeviceLabel normalises a device's self-chosen name: trimmed, bounded, and
 // never empty, since it is what the devices screen shows next to a revoke
 // button — an unlabelled row is one the user cannot safely act on.
-func deviceLabel(raw string) string {
+//
+// Exported for the other place a device name enters this machine's registry:
+// the Name on a fleet device certificate, which the relay transport writes
+// into devices.json for a device some sibling machine paired
+// (internal/transport/relay/channel.go). Signed is not the same as tame —
+// the cert encoding bounds that field at 512 bytes and permits newlines and
+// control characters — so it goes through this normaliser rather than a
+// second, laxer one. One rule for what a device may be called, wherever the
+// name came from.
+func DeviceLabel(raw string) string {
 	l := strings.TrimSpace(raw)
 	if r := []rune(l); len(r) > maxLabelRunes {
 		l = string(r[:maxLabelRunes])
diff --git a/internal/daemon/pairing_test.go b/internal/daemon/pairing_test.go
index 3f816d2..a566544 100644
--- a/internal/daemon/pairing_test.go
+++ b/internal/daemon/pairing_test.go
@@ -2,6 +2,7 @@ package daemon
 
 import (
 	"bytes"
+	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"io"
@@ -15,6 +16,7 @@ import (
 	"time"
 
 	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
@@ -570,6 +572,93 @@ func TestPairDeviceRegistersTheDevice(t *testing.T) {
 	}
 }
 
+// newFleetPairServer is newPairServer with a fleet key, and with or without
+// a place on the relay: machineID is what SetRelayMachine records, and "" is
+// the daemon that never got one.
+func newFleetPairServer(t *testing.T, machineID string) (*Server, fleet.Key) {
+	t.Helper()
+	dir := t.TempDir()
+	key, err := crypto.LoadOrCreateStaticKey(dir)
+	if err != nil {
+		t.Fatalf("LoadOrCreateStaticKey: %v", err)
+	}
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatalf("fleet.Mint: %v", err)
+	}
+	srv := New(session.NewRegistry(time.Now), nil, http.NotFoundHandler(), "test",
+		Identity{Key: key, Devices: crypto.NewDeviceStore(dir), Fleet: fk})
+	t.Cleanup(srv.Shutdown)
+	if machineID != "" {
+		srv.SetRelayMachine(machineID, "Karn's MacBook Pro")
+	}
+	return srv, fk
+}
+
+// TestPairMintsAFleetDeviceCert is the ceremony's half of the fleet key
+// (spec/fleet-trust.md): the machine that ran the pairing signs {device key,
+// name, its own machine id, now} at the moment the ceremony completes, and
+// the registry entry carries the blob. That cert is what admits this device
+// to every sibling machine without a second ceremony, and what the directory
+// stage will publish — so the fields are asserted, not just its presence.
+func TestPairMintsAFleetDeviceCert(t *testing.T) {
+	const machineID = "karns-mbp-a1b2-0f9a12cd"
+	srv, fk := newFleetPairServer(t, machineID)
+
+	token, _ := srv.pairing.start(time.Now())
+	key := deviceKey(0x2a)
+	// Deliberately untidy, to pin which spelling of the name is signed: the
+	// normalised label the registry holds, never the device's raw string.
+	out := srv.PairDevice(pairBody(t, token, base64.StdEncoding.EncodeToString(key), "  phone \n"), "relay")
+	if out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d (%s), want 200", out.Status, out.Body)
+	}
+
+	list := devices(t, srv)
+	if len(list) != 1 {
+		t.Fatalf("registry = %+v, want the one device just paired", list)
+	}
+	cert, err := fleet.VerifyDevice(fk.Public(), list[0].Cert)
+	if err != nil {
+		t.Fatalf("the stored cert does not verify under this daemon's fleet key: %v", err)
+	}
+	if !bytes.Equal(cert.Device, key) {
+		t.Error("the cert names a different device key than the one paired")
+	}
+	if cert.Name != "phone" || cert.Name != list[0].Label {
+		t.Errorf("cert name = %q, want the registry's normalised label %q", cert.Name, list[0].Label)
+	}
+	if cert.PairedOn != machineID {
+		t.Errorf("cert pairedOn = %q, want this machine's relay id %q", cert.PairedOn, machineID)
+	}
+}
+
+// TestPairMintsNoCertWithoutAMachineID: `pairedOn` is a machine id in the
+// spec and the directory the next stage brings keys certs by it, so a cert
+// claiming the empty machine is one nothing can attribute — signing it would
+// put an unusable artifact into the fleet's permanent record. A daemon in
+// that state (holding a fleet key from relay.json, with no place on the relay
+// because relay.New refused the rest of the file, so SetRelayMachine never
+// ran) mints nothing and pairs exactly as a fleet-less daemon does.
+func TestPairMintsNoCertWithoutAMachineID(t *testing.T) {
+	srv, _ := newFleetPairServer(t, "")
+
+	token, _ := srv.pairing.start(time.Now())
+	key := deviceKey(0x2a)
+	out := srv.PairDevice(pairBody(t, token, base64.StdEncoding.EncodeToString(key), "phone"), "relay")
+	if out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d (%s), want 200 — the ceremony is not refused over the cert", out.Status, out.Body)
+	}
+
+	list := devices(t, srv)
+	if len(list) != 1 || list[0].Label != "phone" {
+		t.Fatalf("registry = %+v, want the one device paired as usual", list)
+	}
+	if len(list[0].Cert) != 0 {
+		t.Fatalf("a cert was minted with no machine id to name: %x", list[0].Cert)
+	}
+}
+
 // TestPairDeviceAnswersJSONOnEveryPath is the contract that makes the relay leg
 // possible at all: relaywire.PairResult carries body as a JSON value and
 // EncodeControl refuses anything else, so a refusal that answered the bare
diff --git a/internal/daemon/relayui.go b/internal/daemon/relayui.go
index b4a97e1..e8c2945 100644
--- a/internal/daemon/relayui.go
+++ b/internal/daemon/relayui.go
@@ -27,12 +27,14 @@ const (
 	RelayUpdatePath = "/api/relay/update"
 	// RelayJoinPath answers the join line for adding another machine — the
 	// same string the deploy result shows, rebuilt from relay.json on demand.
-	// It carries the fleet secret, which is why it is its own endpoint behind
-	// a click rather than a field on Info that every page load would fetch:
-	// the secret should cross into a page exactly when a human asked to see
-	// it. Loopback + auth is the boundary that makes even that acceptable —
-	// the cookie behind withAuth already spawns shells, so a page that can
-	// call this could do worse.
+	// It carries both of the relay's credentials — the `DAEMON_SECRET` the
+	// Worker also holds, and the fleet key's seed, which nothing but this
+	// fleet's own machines ever holds (spec/fleet-trust.md) — which is why it
+	// is its own endpoint behind a click rather than a field on Info that
+	// every page load would fetch: they should cross into a page exactly when
+	// a human asked to see them. Loopback + auth is the boundary that makes
+	// even that acceptable — the cookie behind withAuth already spawns
+	// shells, so a page that can call this could do worse.
 	RelayJoinPath = "/api/relay/join"
 	// RelayAddressPath takes {"address": "wss://..."} and repoints relay.json
 	// at a custom domain the user routed to the Worker themselves. No
@@ -53,6 +55,18 @@ type RelayUIStatus struct {
 	Configured bool   `json:"configured"`
 	Origin     string `json:"origin,omitempty"`
 	Worker     string `json:"worker,omitempty"`
+	// Problems are the faults that stop this daemon dialling the relay.json
+	// it has — the same list, in the same words, `flue status` and `flue
+	// relay status` print. Empty for a healthy file and for a machine with
+	// no relay at all.
+	//
+	// It exists because Configured answers a narrower question than the
+	// screen is asking. A file that parses is configured; a file the
+	// transport refuses is not *usable*; and reporting the first as though
+	// it were the second is exactly how an upgrade that silently ended
+	// remote access looked from every surface flue has — one stderr warning
+	// at startup, and three status reports all saying it was fine.
+	Problems []string `json:"problems,omitempty"`
 	// CanDeploy is false in a dev build, which embeds no Worker; Reason is
 	// the sentence the UI shows instead of a button.
 	CanDeploy       bool   `json:"can_deploy"`
@@ -110,8 +124,11 @@ type RelayUIDeployResult struct {
 	// Steps are the ✓ lines, in order — the same sentences the CLI prints.
 	Steps  []string `json:"steps,omitempty"`
 	Origin string   `json:"origin,omitempty"`
-	// JoinCommand is the hand-off line for other machines, secret included.
-	// Shown once, like the CLI's; it is not retrievable from Status.
+	// JoinCommand is the hand-off line for other machines, carrying both of
+	// the credentials a machine needs to join: the daemon secret and the
+	// fleet key's seed. Shown once, like the CLI's; it is not retrievable
+	// from Status — RelayJoinPath rebuilds it, behind a click, for the same
+	// reason.
 	JoinCommand string `json:"join_command,omitempty"`
 	// RestartNeeded is true when a relay transport was already running in
 	// this daemon: the new relay.json takes effect on the next restart, and
diff --git a/internal/daemon/server.go b/internal/daemon/server.go
index 01da1d4..4a19190 100644
--- a/internal/daemon/server.go
+++ b/internal/daemon/server.go
@@ -72,6 +72,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log/slog"
 	"net"
 	"net/http"
@@ -86,6 +87,7 @@ import (
 	"github.com/coder/websocket"
 	"github.com/flynn/noise"
 	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
 	"github.com/karnstack/flue/internal/wire"
@@ -119,6 +121,14 @@ var (
 type Identity struct {
 	Key     noise.DHKey
 	Devices *crypto.DeviceStore
+
+	// Fleet is the fleet key from relay.json (spec/fleet-trust.md), and the
+	// zero value means this daemon has none — a daemon that never joined a
+	// relay, or joined one from before the key existed. With it, a pairing
+	// ceremony also mints a fleet device cert and a revocation also mints
+	// the signed record that keeps the key dead fleet-wide; without it,
+	// both paths run exactly as they always did, minus the signing.
+	Fleet fleet.Key
 }
 
 // Server serves the flue API and the embedded UI on loopback.
@@ -910,6 +920,17 @@ func (s *Server) SetRelayMachine(id, name string) {
 	s.relayMachineID, s.relayMachineName = id, name
 }
 
+// relayMachine reads the identity SetRelayMachine recorded. The id can be
+// empty — a daemon with no relay, or a pairing that raced startup — and the
+// one consumer that persists it (the device cert's pairedOn) records the
+// empty string honestly rather than inventing a name.
+func (s *Server) relayMachine() (m struct{ id, name string }) {
+	s.relayMu.RLock()
+	defer s.relayMu.RUnlock()
+	m.id, m.name = s.relayMachineID, s.relayMachineName
+	return m
+}
+
 // relayInfo is what a welcome carries, or nil when this daemon has no relay.
 //
 // Nil rather than an object saying "off": the field is optional on both sides,
@@ -1145,10 +1166,42 @@ func validDeviceID(id string) bool {
 }
 
 // removeDevice unpairs a device, reporting whether there was one to unpair.
+//
+// On a daemon holding the fleet key, unpairing is two writes and their order
+// is load-bearing: the signed revocation is recorded first, the registry
+// entry removed second. An entry removed without its revocation on file is
+// not revoked at all — the device's fleet cert would walk it straight back
+// into the registry on its next handshake (AddFromFleetCert) — so a
+// revocation that cannot be recorded fails the whole revoke, loudly, rather
+// than performing the half that does not stick. The converse partial (a
+// revocation recorded, the removal failed) is safe, and safe by mechanism
+// rather than by luck: both acceptance paths read the revocation list inside
+// the same critical section as their registry read — crypto.FindByKey for
+// rule 1, AddFromFleetCert for rule 2 — so the key is already dead to the
+// acceptance rule while the entry still shows on the Devices screen, and the
+// retry completes it.
+//
+// The signed blob is kept by the store (crypto.StoredRevocation) because it
+// is the same artifact the fleet directory will publish so every other
+// machine drops the key too; until that stage lands, the record is local
+// and this machine is the only one it binds.
 func (s *Server) removeDevice(id string) (crypto.Device, bool, error) {
 	if s.identity.Devices == nil {
 		return crypto.Device{}, false, errNoDeviceRegistry
 	}
+	if s.identity.Fleet.Valid() {
+		dev, ok, err := s.identity.Devices.FindByID(id)
+		if err != nil || !ok {
+			return crypto.Device{}, ok, err
+		}
+		blob, err := s.identity.Fleet.Sign(fleet.Revocation{Device: dev.PublicKey, IAT: time.Now().Unix()})
+		if err == nil {
+			err = s.identity.Devices.AddRevocation(dev.PublicKey, blob)
+		}
+		if err != nil {
+			return crypto.Device{}, false, fmt.Errorf("daemon: recording the revocation: %w", err)
+		}
+	}
 	return s.identity.Devices.Remove(id)
 }
 
diff --git a/internal/daemon/server_test.go b/internal/daemon/server_test.go
index 0983682..73ea265 100644
--- a/internal/daemon/server_test.go
+++ b/internal/daemon/server_test.go
@@ -2596,7 +2596,7 @@ func TestAuditDoesNotLogAnAcceptedRequest(t *testing.T) {
 // the state it leaves behind.
 func addDevice(t *testing.T, srv *Server, label string, fill byte) crypto.Device {
 	t.Helper()
-	d, err := srv.identity.Devices.Add(label, deviceKey(fill))
+	d, err := srv.identity.Devices.Add(label, deviceKey(fill), nil)
 	if err != nil {
 		t.Fatalf("Add(%q): %v", label, err)
 	}
@@ -3254,7 +3254,7 @@ func (s *stubRelayUI) SetAddress(context.Context, string) (RelayUIDeployResult,
 // daemon whose service has none answers 404 — the same shape as unconfigured.
 func TestRelayUIJoinEndpoint(t *testing.T) {
 	ts, _, srv := newTestServerUI(t, http.NotFoundHandler())
-	srv.SetRelayUI(&stubRelayUI{join: "flue relay join wss://r --secret s"})
+	srv.SetRelayUI(&stubRelayUI{join: "flue relay join wss://r --secret s --fleet f"})
 
 	req, err := http.NewRequest(http.MethodGet, ts.URL+RelayJoinPath, nil)
 	if err != nil {
@@ -3276,7 +3276,7 @@ func TestRelayUIJoinEndpoint(t *testing.T) {
 	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
 		t.Fatalf("decoding: %v", err)
 	}
-	if body.JoinCommand != "flue relay join wss://r --secret s" {
+	if body.JoinCommand != "flue relay join wss://r --secret s --fleet f" {
 		t.Fatalf("join_command = %q", body.JoinCommand)
 	}
 
diff --git a/internal/daemon/transport_test.go b/internal/daemon/transport_test.go
index 547bfb5..d25f9fe 100644
--- a/internal/daemon/transport_test.go
+++ b/internal/daemon/transport_test.go
@@ -150,7 +150,7 @@ func TestServeConnClosesTheTransportOnTheWayOutOfAPanic(t *testing.T) {
 // true once the relay arrives.
 func TestServeConnStampsTheDeviceLastSeen(t *testing.T) {
 	store := crypto.NewDeviceStore(t.TempDir())
-	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32))
+	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32), nil)
 	if err != nil {
 		t.Fatalf("Add: %v", err)
 	}
@@ -195,7 +195,7 @@ func TestServeConnStampsTheDeviceLastSeen(t *testing.T) {
 // being served a shell indefinitely.
 func TestServeConnRefusesADeviceTheRegistryNoLongerHolds(t *testing.T) {
 	store := crypto.NewDeviceStore(t.TempDir())
-	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32))
+	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32), nil)
 	if err != nil {
 		t.Fatalf("Add: %v", err)
 	}
diff --git a/internal/fleet/fixture_test.go b/internal/fleet/fixture_test.go
new file mode 100644
index 0000000..50a0f7a
--- /dev/null
+++ b/internal/fleet/fixture_test.go
@@ -0,0 +1,213 @@
+package fleet
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"flag"
+	"os"
+	"testing"
+)
+
+var update = flag.Bool("update", false, "regenerate testdata/fleet/certs.json")
+
+// certsFixturePath is the cross-language contract for the certificate
+// encoding: this package generates it and asserts every committed case on
+// every run, and the TypeScript sides (browser and, one stage on, whatever
+// reads the fleet directory) walk the same file — the role
+// testdata/relay/machine-ids.json plays for the machine-id MAC and
+// testdata/noise/ik.json for the handshake.
+//
+// Regeneration order matters once: testdata/noise/ik-payload.json embeds
+// this file's device-cert blob as its handshake payload, so regenerate this
+// file first (`go test ./internal/fleet/ -update`), then the noise vectors
+// (`go test ./internal/crypto/ -update`).
+const certsFixturePath = "../../testdata/fleet/certs.json"
+
+// noiseVectorPath is where the fixture borrows its keys from. The device
+// case's key is the noise vectors' initiator static and the machine case's
+// noise key is their responder static, deliberately: the device cert in
+// this file is then a valid handshake payload for the ik-payload vectors,
+// and one replay exercises both fixtures against each other.
+const noiseVectorPath = "../../testdata/noise/ik.json"
+
+type certsFixtureFile struct {
+	// Seed is the fixture fleet key, spelled the way the join line spells
+	// it. Not a credential — it exists to pin arithmetic, like the secrets
+	// in machine-ids.json.
+	Seed string `json:"seed"`
+	// PublicKeyHex is the Ed25519 public key Seed derives — what a consumer
+	// verifies every signedHex under.
+	PublicKeyHex string `json:"publicKeyHex"`
+	Cases        []certsFixtureCase `json:"cases"`
+}
+
+type certsFixtureCase struct {
+	Name string          `json:"name"`
+	Cert certsFixtureDoc `json:"cert"`
+	// CanonicalHex is the canonical encoding — the exact bytes the
+	// signature covers. SignedHex is canonical || signature: the one wire
+	// form, and byte for byte what the IK message-A payload carries.
+	CanonicalHex string `json:"canonicalHex"`
+	SignedHex    string `json:"signedHex"`
+}
+
+// certsFixtureDoc is the cert's fields as JSON, so a consumer builds the
+// cert from named values rather than parsing canonicalHex to learn them.
+type certsFixtureDoc struct {
+	V         int    `json:"v"`
+	Kind      string `json:"kind"`
+	ID        string `json:"id,omitempty"`
+	Name      string `json:"name,omitempty"`
+	NoiseHex  string `json:"noiseHex,omitempty"`
+	DeviceHex string `json:"deviceHex,omitempty"`
+	PairedOn  string `json:"pairedOn,omitempty"`
+	IAT       int64  `json:"iat"`
+}
+
+// fixtureKey is the deterministic fleet key the fixture is signed under.
+func fixtureKey(t *testing.T) Key {
+	t.Helper()
+	seed := sha256.Sum256([]byte("flue-fleet-fixture-key"))
+	k, err := Mint(bytes.NewReader(seed[:]))
+	if err != nil {
+		t.Fatalf("Mint: %v", err)
+	}
+	return k
+}
+
+// noiseFixtureKeys reads the two static public keys out of the committed
+// noise vectors.
+func noiseFixtureKeys(t *testing.T) (initiatorPub, responderPub []byte) {
+	t.Helper()
+	raw, err := os.ReadFile(noiseVectorPath)
+	if err != nil {
+		t.Fatalf("reading %s: %v", noiseVectorPath, err)
+	}
+	var v struct {
+		InitiatorStaticPub string `json:"initiatorStaticPub"`
+		ResponderStaticPub string `json:"responderStaticPub"`
+	}
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatalf("decoding %s: %v", noiseVectorPath, err)
+	}
+	return unhex(t, v.InitiatorStaticPub), unhex(t, v.ResponderStaticPub)
+}
+
+func unhex(t *testing.T, s string) []byte {
+	t.Helper()
+	b, err := hex.DecodeString(s)
+	if err != nil {
+		t.Fatalf("bad hex %q: %v", s, err)
+	}
+	return b
+}
+
+// certsFixtureCases derives every case from the fixture key and the noise
+// vectors' statics. The machine id is machine-ids.json's ordinary case, so
+// the three fixture families name one coherent little fleet. The
+// unicode-name case is the one a byte-length/rune-length confusion gets
+// wrong.
+func certsFixtureCases(t *testing.T, k Key) []certsFixtureCase {
+	t.Helper()
+	devicePub, noisePub := noiseFixtureKeys(t)
+	const machineID = "karns-macbook-pro-a1b2-8ac6565b"
+
+	certs := []struct {
+		name string
+		cert Cert
+	}{
+		{"machine", MachineCert{ID: machineID, Name: "Karn's MacBook Pro", Noise: noisePub, IAT: 1754700000}},
+		{"device", DeviceCert{Device: devicePub, Name: "relayed phone", PairedOn: machineID, IAT: 1754700001}},
+		{"device-unicode-name", DeviceCert{Device: bytes.Repeat([]byte{0x2a}, 32), Name: "Karn’s téléphone 📱", PairedOn: machineID, IAT: 1754700002}},
+		{"revoke", Revocation{Device: devicePub, IAT: 1754700003}},
+	}
+
+	cases := make([]certsFixtureCase, 0, len(certs))
+	for _, c := range certs {
+		canonical, err := Encode(c.cert)
+		if err != nil {
+			t.Fatalf("Encode(%s): %v", c.name, err)
+		}
+		signed, err := k.Sign(c.cert)
+		if err != nil {
+			t.Fatalf("Sign(%s): %v", c.name, err)
+		}
+		doc := certsFixtureDoc{V: certVersion, Kind: c.cert.Kind()}
+		switch cert := c.cert.(type) {
+		case MachineCert:
+			doc.ID, doc.Name, doc.NoiseHex, doc.IAT = cert.ID, cert.Name, hex.EncodeToString(cert.Noise), cert.IAT
+		case DeviceCert:
+			doc.DeviceHex, doc.Name, doc.PairedOn, doc.IAT = hex.EncodeToString(cert.Device), cert.Name, cert.PairedOn, cert.IAT
+		case Revocation:
+			doc.DeviceHex, doc.IAT = hex.EncodeToString(cert.Device), cert.IAT
+		}
+		cases = append(cases, certsFixtureCase{
+			Name:         c.name,
+			Cert:         doc,
+			CanonicalHex: hex.EncodeToString(canonical),
+			SignedHex:    hex.EncodeToString(signed),
+		})
+	}
+	return cases
+}
+
+// TestCertsFixture re-derives every committed case on every run — which is
+// what catches a drifted prefix, field order or signature input — and, with
+// -update, rewrites the file. The committed file is the artifact; the
+// TypeScript suites assert against it without regenerating.
+func TestCertsFixture(t *testing.T) {
+	k := fixtureKey(t)
+	derived := certsFixtureFile{
+		Seed:         k.Seed(),
+		PublicKeyHex: hex.EncodeToString(k.Public()),
+		Cases:        certsFixtureCases(t, k),
+	}
+
+	if *update {
+		if err := os.MkdirAll("../../testdata/fleet", 0o755); err != nil {
+			t.Fatal(err)
+		}
+		b, err := json.MarshalIndent(derived, "", "  ")
+		if err != nil {
+			t.Fatalf("marshalling the fixture: %v", err)
+		}
+		b = append(b, '\n')
+		if err := os.WriteFile(certsFixturePath, b, 0o644); err != nil {
+			t.Fatalf("writing %s: %v", certsFixturePath, err)
+		}
+	}
+
+	raw, err := os.ReadFile(certsFixturePath)
+	if err != nil {
+		t.Fatalf("reading %s (regenerate with -update): %v", certsFixturePath, err)
+	}
+	var committed certsFixtureFile
+	if err := json.Unmarshal(raw, &committed); err != nil {
+		t.Fatalf("decoding %s: %v", certsFixturePath, err)
+	}
+
+	if committed.Seed != derived.Seed || committed.PublicKeyHex != derived.PublicKeyHex {
+		t.Errorf("fixture keys drifted: committed (%s, %s), derived (%s, %s); regenerate with -update if intended",
+			committed.Seed, committed.PublicKeyHex, derived.Seed, derived.PublicKeyHex)
+	}
+	if len(committed.Cases) != len(derived.Cases) {
+		t.Fatalf("%s carries %d cases, this package derives %d; regenerate with -update", certsFixturePath, len(committed.Cases), len(derived.Cases))
+	}
+	for i, want := range committed.Cases {
+		if got := derived.Cases[i]; got != want {
+			t.Errorf("case %q: this package derives %+v, the committed fixture says %+v; regenerate with -update if the change is intended", want.Name, got, want)
+		}
+		// And every committed blob must verify under the committed public
+		// key — the assertion a consumer in another language starts from.
+		cert, err := Verify(unhex(t, committed.PublicKeyHex), unhex(t, want.SignedHex))
+		if err != nil {
+			t.Errorf("case %q: the committed signed blob does not verify: %v", want.Name, err)
+			continue
+		}
+		if cert.Kind() != want.Cert.Kind {
+			t.Errorf("case %q: the committed blob decodes as a %s cert, the doc says %s", want.Name, cert.Kind(), want.Cert.Kind)
+		}
+	}
+}
diff --git a/internal/fleet/fleet.go b/internal/fleet/fleet.go
new file mode 100644
index 0000000..f73766c
--- /dev/null
+++ b/internal/fleet/fleet.go
@@ -0,0 +1,471 @@
+// Package fleet is the fleet key and the certificates it signs
+// (spec/fleet-trust.md): one Ed25519 keypair per relay, held by every machine
+// and never by the Worker, whose signatures are what let a device paired on
+// one machine be trusted by every other.
+//
+// Three certificate kinds exist and no more: a machine cert (a machine
+// naming itself and its Noise static key), a device cert (a pairing ceremony
+// naming the device key it admitted), and a revocation (the operator naming
+// a device key that is dead). All three are detached Ed25519 signatures over
+// a canonical encoding of the named fields; the signed blob — canonical
+// bytes then the 64-byte signature — is the one wire form, carried in the
+// IK handshake's first message today and by the relay's fleet directory in
+// the stage that follows. testdata/fleet/certs.json pins the bytes for every
+// implementation.
+package fleet
+
+import (
+	"crypto/ed25519"
+	"encoding/base64"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"unicode/utf8"
+)
+
+// Canonical encoding.
+//
+// The spec allows canonical CBOR or a length-prefixed encoding, pinned by
+// test vectors either way. This package is length-prefixed, deliberately:
+// canonical CBOR buys nothing for three record shapes with fixed field sets,
+// and costs either a dependency (Go's standard library has no CBOR) or a
+// hand-rolled subset whose canonicity rules — definite lengths, sorted map
+// keys, shortest-form integers — are exactly the ambiguity a canonical
+// encoding exists to rule out. A fixed field order with explicit lengths has
+// no map to order and no integer forms to choose between: two
+// implementations either produce the same bytes or fail the fixture.
+//
+// The layout, byte for byte:
+//
+//	"flue-fleet-cert/"          16 ASCII bytes — domain separation, the same
+//	                            style as the machine-id MAC's prefix, so a
+//	                            fleet signature can never be confused with
+//	                            anything else the fleet key might one day sign
+//	u8  v                       1
+//	u8  kind                    1 machine, 2 device, 3 revoke
+//	then the spec's fields for that kind, in the spec's order:
+//	  machine:  str(id)  str(name)  key32(noise)   u64(iat)
+//	  device:   key32(device)  str(name)  str(pairedOn)  u64(iat)
+//	  revoke:   key32(device)  u64(iat)
+//
+//	str    = u16 big-endian byte length, then that many bytes of UTF-8
+//	key32  = exactly 32 raw bytes, no length prefix
+//	u64    = 8 bytes big-endian (iat is unix seconds and never negative)
+//
+// The signature is Ed25519 over exactly the canonical bytes, and the signed
+// blob is canonical || signature. The canonical part is self-delimiting —
+// fixed layout per kind, explicit string lengths — so the blob parses
+// unambiguously: whatever remains after the fields must be exactly the 64
+// signature bytes, and a blob with anything more or less is refused.
+const (
+	// certPrefix is the domain separator every canonical encoding opens with.
+	certPrefix = "flue-fleet-cert/"
+
+	// certVersion is the one version this package writes and accepts.
+	certVersion = 1
+
+	// kind bytes, in the order the spec lists the kinds.
+	kindMachine = 1
+	kindDevice  = 2
+	kindRevoke  = 3
+
+	// maxStringBytes bounds every string field, on encode and on decode. The
+	// fields are bounded upstream anyway — machine ids are at most 63
+	// characters, display names at most 64 runes — but a decoder that reads a
+	// length from an unauthenticated blob must impose its own ceiling rather
+	// than inherit one.
+	maxStringBytes = 512
+
+	// maxIAT is the ceiling on iat, on encode and on decode both — one
+	// constant, because a value the encoder accepts and the decoder refuses
+	// is a cert this package would sign and then fail to verify. Unix
+	// seconds do not reach 2^62 (that is some 146 billion years out), so
+	// anything at or above it is not a time; refusing it here is what keeps
+	// every decoded iat safe to hand to time.Unix.
+	maxIAT = 1 << 62
+
+	// keyBytes is an X25519 public key, the only kind of key a cert names.
+	keyBytes = 32
+
+	// SeedEncodedLen is how long an encoded fleet seed is: 32 bytes of
+	// Ed25519 seed in unpadded base64url, as the join line carries it.
+	SeedEncodedLen = 43
+)
+
+// Kind names, as the spec writes them and as fixtures carry them.
+const (
+	KindMachine = "machine"
+	KindDevice  = "device"
+	KindRevoke  = "revoke"
+)
+
+var (
+	// ErrBadCert is any blob that does not parse as a signed certificate:
+	// wrong prefix, wrong version, truncated fields, trailing bytes.
+	ErrBadCert = errors.New("fleet: not a certificate")
+
+	// ErrBadSignature is a well-formed blob whose signature does not verify
+	// under the given fleet public key.
+	ErrBadSignature = errors.New("fleet: the signature does not verify")
+
+	// ErrNoKey is a signing or seed operation asked of a zero Key.
+	ErrNoKey = errors.New("fleet: no fleet key")
+)
+
+// Key is the fleet key: the Ed25519 keypair `flue relay setup` mints, whose
+// seed rides the join line and lands in relay.json on every machine. The
+// zero value is "no fleet key" — Valid reports it, Sign refuses it — so a
+// daemon on a relay from before the key existed carries exactly that.
+type Key struct {
+	priv ed25519.PrivateKey
+}
+
+// Mint makes a fresh fleet key from r, which is crypto/rand.Reader
+// everywhere but tests.
+func Mint(r io.Reader) (Key, error) {
+	seed := make([]byte, ed25519.SeedSize)
+	if _, err := io.ReadFull(r, seed); err != nil {
+		return Key{}, fmt.Errorf("fleet: reading randomness for a fleet key: %w", err)
+	}
+	return Key{priv: ed25519.NewKeyFromSeed(seed)}, nil
+}
+
+// Parse reads a seed as the join line spells it: 32 bytes in unpadded
+// base64url. It is strict — padded, standard-alphabet or wrong-length input
+// is refused rather than guessed at, because the value arrives pasted across
+// machines and a mangled seed that half-parsed would join a machine to a
+// fleet whose signatures it can never verify.
+func Parse(seed string) (Key, error) {
+	raw, err := base64.RawURLEncoding.DecodeString(seed)
+	if err != nil {
+		return Key{}, fmt.Errorf("fleet: the fleet key is not unpadded base64url: %w", err)
+	}
+	if len(raw) != ed25519.SeedSize {
+		return Key{}, fmt.Errorf("fleet: the fleet key must be %d bytes, got %d", ed25519.SeedSize, len(raw))
+	}
+	return Key{priv: ed25519.NewKeyFromSeed(raw)}, nil
+}
+
+// Valid reports whether this is a real key rather than the zero value.
+func (k Key) Valid() bool { return len(k.priv) == ed25519.PrivateKeySize }
+
+// Seed is the key as the join line and relay.json carry it: the 32-byte
+// Ed25519 seed, unpadded base64url. Empty for the zero Key.
+func (k Key) Seed() string {
+	if !k.Valid() {
+		return ""
+	}
+	return base64.RawURLEncoding.EncodeToString(k.priv.Seed())
+}
+
+// Public is the fleet public key — what every machine and every paired
+// device verifies certs under. Nil for the zero Key.
+func (k Key) Public() ed25519.PublicKey {
+	if !k.Valid() {
+		return nil
+	}
+	return k.priv.Public().(ed25519.PublicKey)
+}
+
+// Sign encodes c canonically and returns the signed blob: the canonical
+// bytes followed by the 64-byte Ed25519 signature over them.
+func (k Key) Sign(c Cert) ([]byte, error) {
+	if !k.Valid() {
+		return nil, ErrNoKey
+	}
+	canonical, err := Encode(c)
+	if err != nil {
+		return nil, err
+	}
+	return append(canonical, ed25519.Sign(k.priv, canonical)...), nil
+}
+
+// Cert is one of the three certificate kinds. It is a sealed interface —
+// the encoding has exactly three layouts, and a fourth implementer would be
+// bytes no verifier recognises.
+type Cert interface {
+	// Kind is the spec's name for this certificate's kind.
+	Kind() string
+
+	kindByte() byte
+	encodeBody(b []byte) ([]byte, error)
+}
+
+// MachineCert is a machine naming itself: minted by the machine, for
+// itself, at join or setup time. Browsers verify it to learn which Noise
+// static key to pin for the machine; nothing daemon-side consumes it yet
+// (the fleet directory that distributes it is the stage after this one).
+type MachineCert struct {
+	ID    string // the machine id, as minted by config.MintMachineID
+	Name  string // the machine's display name
+	Noise []byte // the daemon's static X25519 public key, 32 bytes
+	IAT   int64  // unix seconds, for display; certs deliberately never expire
+}
+
+func (MachineCert) Kind() string   { return KindMachine }
+func (MachineCert) kindByte() byte { return kindMachine }
+
+func (c MachineCert) encodeBody(b []byte) ([]byte, error) {
+	b, err := appendString(b, "id", c.ID)
+	if err != nil {
+		return nil, err
+	}
+	if b, err = appendString(b, "name", c.Name); err != nil {
+		return nil, err
+	}
+	if b, err = appendKey(b, "noise", c.Noise); err != nil {
+		return nil, err
+	}
+	return appendIAT(b, c.IAT)
+}
+
+// DeviceCert is a pairing ceremony's outcome: minted by whichever machine
+// ran the ceremony, at the moment it completed, naming the device key it
+// admitted. A daemon that has never seen the key admits it on this cert
+// alone — which is the whole point of the fleet key.
+type DeviceCert struct {
+	Device   []byte // the device's static X25519 public key, 32 bytes
+	Name     string // the device's display name, as the ceremony recorded it
+	PairedOn string // the machine id the ceremony ran on
+	IAT      int64
+}
+
+func (DeviceCert) Kind() string   { return KindDevice }
+func (DeviceCert) kindByte() byte { return kindDevice }
+
+func (c DeviceCert) encodeBody(b []byte) ([]byte, error) {
+	b, err := appendKey(b, "device", c.Device)
+	if err != nil {
+		return nil, err
+	}
+	if b, err = appendString(b, "name", c.Name); err != nil {
+		return nil, err
+	}
+	if b, err = appendString(b, "pairedOn", c.PairedOn); err != nil {
+		return nil, err
+	}
+	return appendIAT(b, c.IAT)
+}
+
+// Revocation is the operator killing a device key, minted by whichever
+// machine the revoke ran on. It permanently outranks any device cert for
+// the same key, whatever either one's timestamp says: iat is display, not
+// precedence, and un-revoking is pairing again under a fresh key. Verifiers
+// must implement it that way — check the revocation set before honouring a
+// device cert, and never compare the two by time.
+type Revocation struct {
+	Device []byte // the revoked device key, 32 bytes
+	IAT    int64
+}
+
+func (Revocation) Kind() string   { return KindRevoke }
+func (Revocation) kindByte() byte { return kindRevoke }
+
+func (c Revocation) encodeBody(b []byte) ([]byte, error) {
+	b, err := appendKey(b, "device", c.Device)
+	if err != nil {
+		return nil, err
+	}
+	return appendIAT(b, c.IAT)
+}
+
+// Encode is the canonical encoding of c — the exact bytes a signature
+// covers. Exported for the fixture generator; everything else wants Sign
+// and Verify, which carry the signature with the bytes.
+func Encode(c Cert) ([]byte, error) {
+	b := make([]byte, 0, 128)
+	b = append(b, certPrefix...)
+	b = append(b, certVersion, c.kindByte())
+	return c.encodeBody(b)
+}
+
+// Verify parses a signed blob, checks its signature under the fleet public
+// key, and returns the typed certificate. Every fault is an error: a blob
+// that is not a cert, trailing bytes, a signature that does not verify.
+// Callers must treat the returned cert as meaningful only for the checks
+// they then perform themselves — above all that a revocation for the same
+// key outranks a device cert regardless of either iat.
+func Verify(pub ed25519.PublicKey, blob []byte) (Cert, error) {
+	if len(pub) != ed25519.PublicKeySize {
+		return nil, fmt.Errorf("%w: the fleet public key must be %d bytes, got %d", ErrBadSignature, ed25519.PublicKeySize, len(pub))
+	}
+	cert, canonicalLen, err := decode(blob)
+	if err != nil {
+		return nil, err
+	}
+	if len(blob)-canonicalLen != ed25519.SignatureSize {
+		return nil, fmt.Errorf("%w: %d bytes after the fields, want a %d-byte signature",
+			ErrBadCert, len(blob)-canonicalLen, ed25519.SignatureSize)
+	}
+	if !ed25519.Verify(pub, blob[:canonicalLen], blob[canonicalLen:]) {
+		return nil, ErrBadSignature
+	}
+	return cert, nil
+}
+
+// VerifyDevice is Verify for the one place that only a device cert will do:
+// the daemon's handshake payload. A machine cert or a revocation in that
+// position is well-signed and still refused.
+func VerifyDevice(pub ed25519.PublicKey, blob []byte) (DeviceCert, error) {
+	c, err := Verify(pub, blob)
+	if err != nil {
+		return DeviceCert{}, err
+	}
+	dc, ok := c.(DeviceCert)
+	if !ok {
+		return DeviceCert{}, fmt.Errorf("%w: a %s certificate where a device certificate belongs", ErrBadCert, c.Kind())
+	}
+	return dc, nil
+}
+
+// --- encoding primitives ---
+
+func appendString(b []byte, field, s string) ([]byte, error) {
+	if len(s) > maxStringBytes {
+		return nil, fmt.Errorf("fleet: %s is %d bytes, the ceiling is %d", field, len(s), maxStringBytes)
+	}
+	if !utf8.ValidString(s) {
+		// The encoding says UTF-8 and means it: a Go string can carry any
+		// bytes, and two implementations that disagreed about what a string
+		// field may hold would disagree about which blobs verify.
+		return nil, fmt.Errorf("fleet: %s is not valid UTF-8", field)
+	}
+	b = binary.BigEndian.AppendUint16(b, uint16(len(s)))
+	return append(b, s...), nil
+}
+
+func appendKey(b []byte, field string, key []byte) ([]byte, error) {
+	if len(key) != keyBytes {
+		return nil, fmt.Errorf("fleet: %s must be %d bytes, got %d", field, keyBytes, len(key))
+	}
+	return append(b, key...), nil
+}
+
+func appendIAT(b []byte, iat int64) ([]byte, error) {
+	if iat < 0 {
+		return nil, fmt.Errorf("fleet: iat %d is negative", iat)
+	}
+	if iat > maxIAT {
+		// The same ceiling reader.iat holds the wire to. Without it this
+		// encoder would happily sign a math.MaxInt64 iat that its own Verify
+		// then refuses — a cert minted and dead in the same breath, and the
+		// kind of asymmetry a fixture cannot catch because no honest caller
+		// produces one.
+		return nil, fmt.Errorf("fleet: iat %d is not a unix time", iat)
+	}
+	return binary.BigEndian.AppendUint64(b, uint64(iat)), nil
+}
+
+// decode parses the canonical part of a signed blob, returning the typed
+// cert and how many bytes of blob the canonical encoding covered. It never
+// looks at the signature; Verify owns that.
+func decode(blob []byte) (Cert, int, error) {
+	r := &reader{b: blob}
+	prefix, err := r.take(len(certPrefix))
+	if err != nil || string(prefix) != certPrefix {
+		return nil, 0, fmt.Errorf("%w: it does not open with %q", ErrBadCert, certPrefix)
+	}
+	header, err := r.take(2)
+	if err != nil {
+		return nil, 0, fmt.Errorf("%w: truncated before the version", ErrBadCert)
+	}
+	if header[0] != certVersion {
+		return nil, 0, fmt.Errorf("%w: version %d, this implementation speaks %d", ErrBadCert, header[0], certVersion)
+	}
+
+	var cert Cert
+	switch header[1] {
+	case kindMachine:
+		var c MachineCert
+		if c.ID, err = r.str(); err == nil {
+			if c.Name, err = r.str(); err == nil {
+				if c.Noise, err = r.key(); err == nil {
+					c.IAT, err = r.iat()
+				}
+			}
+		}
+		cert = c
+	case kindDevice:
+		var c DeviceCert
+		if c.Device, err = r.key(); err == nil {
+			if c.Name, err = r.str(); err == nil {
+				if c.PairedOn, err = r.str(); err == nil {
+					c.IAT, err = r.iat()
+				}
+			}
+		}
+		cert = c
+	case kindRevoke:
+		var c Revocation
+		if c.Device, err = r.key(); err == nil {
+			c.IAT, err = r.iat()
+		}
+		cert = c
+	default:
+		return nil, 0, fmt.Errorf("%w: kind byte %d", ErrBadCert, header[1])
+	}
+	if err != nil {
+		return nil, 0, err
+	}
+	return cert, r.off, nil
+}
+
+// reader walks a blob field by field. Its errors all wrap ErrBadCert.
+type reader struct {
+	b   []byte
+	off int
+}
+
+func (r *reader) take(n int) ([]byte, error) {
+	if len(r.b)-r.off < n {
+		return nil, fmt.Errorf("%w: truncated at byte %d", ErrBadCert, r.off)
+	}
+	out := r.b[r.off : r.off+n]
+	r.off += n
+	return out, nil
+}
+
+func (r *reader) str() (string, error) {
+	lb, err := r.take(2)
+	if err != nil {
+		return "", err
+	}
+	n := int(binary.BigEndian.Uint16(lb))
+	if n > maxStringBytes {
+		return "", fmt.Errorf("%w: a %d-byte string field, the ceiling is %d", ErrBadCert, n, maxStringBytes)
+	}
+	raw, err := r.take(n)
+	if err != nil {
+		return "", err
+	}
+	if !utf8.Valid(raw) {
+		return "", fmt.Errorf("%w: a string field that is not UTF-8", ErrBadCert)
+	}
+	return string(raw), nil
+}
+
+func (r *reader) key() ([]byte, error) {
+	raw, err := r.take(keyBytes)
+	if err != nil {
+		return nil, err
+	}
+	// Cloned: the caller's cert outlives the blob it was parsed from.
+	out := make([]byte, keyBytes)
+	copy(out, raw)
+	return out, nil
+}
+
+func (r *reader) iat() (int64, error) {
+	raw, err := r.take(8)
+	if err != nil {
+		return 0, err
+	}
+	v := binary.BigEndian.Uint64(raw)
+	if v > maxIAT {
+		// The same ceiling appendIAT encodes under, so this package never
+		// signs bytes it would then refuse.
+		return 0, fmt.Errorf("%w: iat %d is not a unix time", ErrBadCert, v)
+	}
+	return int64(v), nil
+}
diff --git a/internal/fleet/fleet_test.go b/internal/fleet/fleet_test.go
new file mode 100644
index 0000000..3af001a
--- /dev/null
+++ b/internal/fleet/fleet_test.go
@@ -0,0 +1,294 @@
+package fleet
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	"crypto/sha256"
+	"encoding/binary"
+	"errors"
+	"math"
+	"strings"
+	"testing"
+)
+
+// testKey is a deterministic fleet key so failures print stable bytes.
+func testKey(t *testing.T) Key {
+	t.Helper()
+	seed := sha256.Sum256([]byte("fleet-test-key"))
+	k, err := Mint(bytes.NewReader(seed[:]))
+	if err != nil {
+		t.Fatalf("Mint: %v", err)
+	}
+	return k
+}
+
+func key32(fill byte) []byte { return bytes.Repeat([]byte{fill}, 32) }
+
+func testCerts() []Cert {
+	return []Cert{
+		MachineCert{ID: "karns-mbp-a1b2-8ac6565b", Name: "Karn's MacBook Pro", Noise: key32(0x11), IAT: 1754700000},
+		DeviceCert{Device: key32(0x22), Name: "relayed phone", PairedOn: "karns-mbp-a1b2-8ac6565b", IAT: 1754700001},
+		Revocation{Device: key32(0x22), IAT: 1754700002},
+	}
+}
+
+// TestSignVerifyRoundTrip: every kind signs, verifies under the right key,
+// and comes back field for field.
+func TestSignVerifyRoundTrip(t *testing.T) {
+	k := testKey(t)
+	for _, c := range testCerts() {
+		blob, err := k.Sign(c)
+		if err != nil {
+			t.Fatalf("Sign(%s): %v", c.Kind(), err)
+		}
+		got, err := Verify(k.Public(), blob)
+		if err != nil {
+			t.Fatalf("Verify(%s): %v", c.Kind(), err)
+		}
+		switch want := c.(type) {
+		case MachineCert:
+			g, ok := got.(MachineCert)
+			if !ok || g.ID != want.ID || g.Name != want.Name || !bytes.Equal(g.Noise, want.Noise) || g.IAT != want.IAT {
+				t.Errorf("machine cert round-tripped to %#v, want %#v", got, want)
+			}
+		case DeviceCert:
+			g, ok := got.(DeviceCert)
+			if !ok || !bytes.Equal(g.Device, want.Device) || g.Name != want.Name || g.PairedOn != want.PairedOn || g.IAT != want.IAT {
+				t.Errorf("device cert round-tripped to %#v, want %#v", got, want)
+			}
+		case Revocation:
+			g, ok := got.(Revocation)
+			if !ok || !bytes.Equal(g.Device, want.Device) || g.IAT != want.IAT {
+				t.Errorf("revocation round-tripped to %#v, want %#v", got, want)
+			}
+		}
+	}
+}
+
+// TestVerifyRefusesTheWrongKey: a cert signed by one fleet must not verify
+// under another's public key.
+func TestVerifyRefusesTheWrongKey(t *testing.T) {
+	k := testKey(t)
+	otherSeed := sha256.Sum256([]byte("some-other-fleet"))
+	other, err := Mint(bytes.NewReader(otherSeed[:]))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range testCerts() {
+		blob, err := k.Sign(c)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := Verify(other.Public(), blob); !errors.Is(err, ErrBadSignature) {
+			t.Errorf("Verify(%s) under a foreign key = %v, want ErrBadSignature", c.Kind(), err)
+		}
+	}
+}
+
+// TestVerifyRefusesTampering: every flipped bit — in the fields or in the
+// signature — is a refusal, and so is anything appended or truncated.
+func TestVerifyRefusesTampering(t *testing.T) {
+	k := testKey(t)
+	blob, err := k.Sign(testCerts()[1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range blob {
+		bad := bytes.Clone(blob)
+		bad[i] ^= 0x01
+		if _, err := Verify(k.Public(), bad); err == nil {
+			t.Fatalf("a blob with byte %d flipped verified", i)
+		}
+	}
+	if _, err := Verify(k.Public(), append(bytes.Clone(blob), 0x00)); !errors.Is(err, ErrBadCert) {
+		t.Errorf("a blob with a trailing byte = %v, want ErrBadCert", err)
+	}
+	if _, err := Verify(k.Public(), blob[:len(blob)-1]); !errors.Is(err, ErrBadCert) {
+		t.Errorf("a truncated blob = %v, want ErrBadCert", err)
+	}
+	if _, err := Verify(k.Public(), nil); !errors.Is(err, ErrBadCert) {
+		t.Errorf("an empty blob = %v, want ErrBadCert", err)
+	}
+}
+
+// TestVerifyDeviceRefusesOtherKinds: a well-signed machine cert or
+// revocation in the handshake-payload position is still refused — kind
+// confusion is exactly what the kind byte under the signature prevents.
+func TestVerifyDeviceRefusesOtherKinds(t *testing.T) {
+	k := testKey(t)
+	for _, c := range []Cert{testCerts()[0], testCerts()[2]} {
+		blob, err := k.Sign(c)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := VerifyDevice(k.Public(), blob); !errors.Is(err, ErrBadCert) {
+			t.Errorf("VerifyDevice(%s) = %v, want ErrBadCert", c.Kind(), err)
+		}
+	}
+	blob, err := k.Sign(testCerts()[1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	dc, err := VerifyDevice(k.Public(), blob)
+	if err != nil || !bytes.Equal(dc.Device, key32(0x22)) {
+		t.Errorf("VerifyDevice on a device cert = %#v, %v", dc, err)
+	}
+}
+
+// TestEncodeRefusesBadFields: the encoder is the last line before a
+// signature makes bad bytes permanent.
+func TestEncodeRefusesBadFields(t *testing.T) {
+	cases := []struct {
+		name string
+		cert Cert
+	}{
+		{"short device key", DeviceCert{Device: key32(0x22)[:31], Name: "p", PairedOn: "m", IAT: 1}},
+		{"long device key", DeviceCert{Device: bytes.Repeat([]byte{0x22}, 33), Name: "p", PairedOn: "m", IAT: 1}},
+		{"nil noise key", MachineCert{ID: "m", Name: "m", Noise: nil, IAT: 1}},
+		{"negative iat", Revocation{Device: key32(0x01), IAT: -1}},
+		{"oversized name", DeviceCert{Device: key32(0x22), Name: strings.Repeat("a", maxStringBytes+1), PairedOn: "m", IAT: 1}},
+		{"non-UTF-8 name", DeviceCert{Device: key32(0x22), Name: string([]byte{0xff, 0xfe}), PairedOn: "m", IAT: 1}},
+	}
+	for _, tc := range cases {
+		if _, err := Encode(tc.cert); err == nil {
+			t.Errorf("%s: Encode accepted it", tc.name)
+		}
+	}
+}
+
+// signRaw signs canonical bytes no Cert value could produce, so the tests
+// below can present a blob whose *only* fault is the one under test. Without
+// it every one of them would pass for the wrong reason — an unsigned blob
+// fails the signature check whatever its fields say, which proves nothing
+// about the parse.
+func signRaw(t *testing.T, k Key, canonical []byte) []byte {
+	t.Helper()
+	return append(bytes.Clone(canonical), ed25519.Sign(k.priv, canonical)...)
+}
+
+// TestVerifyRefusesAnUnknownVersion: a version byte this implementation does
+// not speak is refused even under a perfect fleet signature. The version is
+// inside the signed bytes precisely so it cannot be edited by anyone but the
+// fleet — and a future v2 must not be read as a v1 with different meanings.
+func TestVerifyRefusesAnUnknownVersion(t *testing.T) {
+	k := testKey(t)
+	canonical, err := Encode(testCerts()[2])
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical[len(certPrefix)] = certVersion + 1
+	_, err = Verify(k.Public(), signRaw(t, k, canonical))
+	if !errors.Is(err, ErrBadCert) || !strings.Contains(err.Error(), "version") {
+		t.Fatalf("a signed v%d blob = %v, want ErrBadCert naming the version", certVersion+1, err)
+	}
+}
+
+// TestVerifyRefusesAnUnknownKind: the kind byte is the tag the three layouts
+// are told apart by, so a fourth value has no layout to parse and must not be
+// guessed at. Signed, for the reason above.
+func TestVerifyRefusesAnUnknownKind(t *testing.T) {
+	k := testKey(t)
+	canonical, err := Encode(testCerts()[2])
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical[len(certPrefix)+1] = kindRevoke + 1
+	_, err = Verify(k.Public(), signRaw(t, k, canonical))
+	if !errors.Is(err, ErrBadCert) || !strings.Contains(err.Error(), "kind byte") {
+		t.Fatalf("a signed blob with an unknown kind = %v, want ErrBadCert naming the kind byte", err)
+	}
+}
+
+// TestDecodeRefusesAnOversizedStringLength: the decoder holds its own ceiling
+// on a length it reads out of a blob, rather than inheriting the bounds the
+// minting paths happen to impose. Signed under the real fleet key, because
+// the ceiling has to hold against a blob that verifies — a fleet key on a
+// compromised machine, or simply a future field bound that grew — and not
+// only against garbage.
+func TestDecodeRefusesAnOversizedStringLength(t *testing.T) {
+	k := testKey(t)
+	var canonical []byte
+	canonical = append(canonical, certPrefix...)
+	canonical = append(canonical, certVersion, kindMachine)
+	canonical = binary.BigEndian.AppendUint16(canonical, uint16(maxStringBytes+1))
+	canonical = append(canonical, bytes.Repeat([]byte{'a'}, maxStringBytes+1)...)
+	canonical = binary.BigEndian.AppendUint16(canonical, 0)
+	canonical = append(canonical, key32(0x11)...)
+	canonical = binary.BigEndian.AppendUint64(canonical, 1754700000)
+
+	_, err := Verify(k.Public(), signRaw(t, k, canonical))
+	if !errors.Is(err, ErrBadCert) || !strings.Contains(err.Error(), "ceiling") {
+		t.Fatalf("a signed blob with a %d-byte string field = %v, want ErrBadCert naming the ceiling", maxStringBytes+1, err)
+	}
+}
+
+// TestIATCeilingIsSharedByBothSides: the encoder must never sign an iat its
+// own Verify refuses. maxIAT is one constant for exactly that reason — before
+// it was, Sign(IAT: math.MaxInt64) succeeded and Verify rejected the bytes it
+// had just produced.
+func TestIATCeilingIsSharedByBothSides(t *testing.T) {
+	k := testKey(t)
+	if _, err := k.Sign(Revocation{Device: key32(0x22), IAT: math.MaxInt64}); err == nil {
+		t.Fatal("Sign accepted an iat that is not a unix time")
+	}
+	// The ceiling itself is on the accepting side of the line on both ends.
+	blob, err := k.Sign(Revocation{Device: key32(0x22), IAT: maxIAT})
+	if err != nil {
+		t.Fatalf("Sign at the ceiling: %v", err)
+	}
+	if _, err := Verify(k.Public(), blob); err != nil {
+		t.Fatalf("Verify of a blob signed at the ceiling: %v", err)
+	}
+}
+
+// TestSeedRoundTrip: the join line's spelling of the key comes back as the
+// same key, and the strict parses refuse what they should.
+func TestSeedRoundTrip(t *testing.T) {
+	k := testKey(t)
+	seed := k.Seed()
+	if len(seed) != SeedEncodedLen {
+		t.Fatalf("Seed() is %d characters, want %d", len(seed), SeedEncodedLen)
+	}
+	back, err := Parse(seed)
+	if err != nil {
+		t.Fatalf("Parse(Seed()): %v", err)
+	}
+	if !bytes.Equal(back.Public(), k.Public()) {
+		t.Fatal("the re-parsed key derives a different public key")
+	}
+
+	for _, bad := range []string{"", "not base64url!!", seed + "=", seed[:10], seed + seed} {
+		if _, err := Parse(bad); err == nil {
+			t.Errorf("Parse(%q) accepted it", bad)
+		}
+	}
+}
+
+// TestZeroKey: the zero value means "no fleet key" and behaves like it.
+func TestZeroKey(t *testing.T) {
+	var k Key
+	if k.Valid() {
+		t.Error("the zero Key claims to be valid")
+	}
+	if k.Seed() != "" || k.Public() != nil {
+		t.Error("the zero Key has a seed or a public key")
+	}
+	if _, err := k.Sign(testCerts()[2]); !errors.Is(err, ErrNoKey) {
+		t.Errorf("Sign on the zero Key = %v, want ErrNoKey", err)
+	}
+}
+
+// TestVerifyRefusesABogusPublicKey: a verifier misconfigured with an empty
+// or short key must refuse everything rather than panic or accept.
+func TestVerifyRefusesABogusPublicKey(t *testing.T) {
+	k := testKey(t)
+	blob, err := k.Sign(testCerts()[2])
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, pub := range []ed25519.PublicKey{nil, k.Public()[:31]} {
+		if _, err := Verify(pub, blob); err == nil {
+			t.Errorf("Verify under a %d-byte public key accepted the blob", len(pub))
+		}
+	}
+}
diff --git a/internal/transport/relay/channel.go b/internal/transport/relay/channel.go
index 152f310..ed4eed3 100644
--- a/internal/transport/relay/channel.go
+++ b/internal/transport/relay/channel.go
@@ -5,10 +5,14 @@ package relay
 //
 // Everything here answers one question — is this browser a device the user
 // paired? The relay cannot answer it and is not asked to: it forwards opaque
-// bytes, and the proof arrives as the initiator's static key coming out of a
-// Noise IK handshake this process runs itself, checked against the device
-// registry on this machine. A key the registry does not hold is closed, not
-// served, however well-formed its handshake was.
+// bytes, and the proof arrives out of a Noise IK handshake this process runs
+// itself. Two proofs are accepted, in order (spec/fleet-trust.md): the
+// initiator's static key is in this machine's own device registry and not on
+// its revocation list, or the handshake's first message carried a device
+// certificate for exactly that key, signed by the fleet key and not revoked —
+// a device paired on a sibling machine, which this one then records as its
+// own. A key with neither is closed, not served, however well-formed its
+// handshake was.
 
 import (
 	"bytes"
@@ -23,6 +27,7 @@ import (
 
 	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 )
 
@@ -337,7 +342,7 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 		}
 	}()
 
-	nch, peerStatic, err := t.handshake(s, ch)
+	nch, peerStatic, payload, err := t.handshake(s, ch)
 	if err != nil {
 		if errors.Is(err, errChannelGone) || errors.Is(err, errSocketClosed) {
 			// The browser left, or the socket did, mid-handshake. Ordinary, and
@@ -350,16 +355,33 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 		return
 	}
 
+	// Rule 1, and both halves of it: FindByKey answers "paired here, and not
+	// revoked here" in one critical section (crypto.DeviceStore.FindByKey).
+	// The revocation half is not belt and braces — revoking writes the
+	// revocation before it removes the registry entry, so an entry that
+	// outlived a half-completed revoke is exactly the case a registry-only
+	// lookup would wave through.
 	dev, paired, err := t.devices.FindByKey(peerStatic)
 	if err != nil {
-		// The registry could not be read. Refusing is the only safe direction:
-		// this daemon cannot tell a paired device from an unpaired one right
-		// now, and it is not going to guess.
+		// The registry, or the revocation list it is read against, could not
+		// be read. Refusing is the only safe direction: this daemon cannot
+		// tell a paired device from an unpaired or a revoked one right now,
+		// and it is not going to guess.
 		t.log.Error("could not read the device registry for a relayed browser",
 			"channel", ch.id, "err", err)
 		t.tell(s, relaywire.Close{Channel: ch.id})
 		return
 	}
+	if !paired {
+		// Rule 2 of the acceptance order: a key this machine never paired,
+		// carrying a fleet device cert in its handshake payload. Rule 1 above
+		// deliberately never looked at the payload — a device in the registry
+		// is served cert or no cert, so pairing on this machine keeps working
+		// if the fleet key ever rotates away. A revoked key reaches here too,
+		// and meets the same refusal on the way through: AddFromFleetCert
+		// checks the revocation list inside its own write.
+		dev, paired = t.admitByFleetCert(ch, peerStatic, payload)
+	}
 	if !paired {
 		// Not an error, a state: an unpaired browser cannot attach, and pairing
 		// is what makes it known. The id logged is the digest of the key it
@@ -385,9 +407,86 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 	t.log.Debug("relay channel ended", "channel", ch.id, "device", dev.ID)
 }
 
+// admitByFleetCert decides whether an unregistered key gets in on its
+// handshake payload: a fleet device certificate that verifies under the
+// fleet public key, names exactly the handshake's static key, and is not
+// revoked. A yes also writes the device into this machine's registry under
+// the cert's name — so the Devices screen shows it, LastSeen works, and the
+// daemon keeps serving it even if the fleet key later rotates away.
+//
+// The refusals are all the same silent false — the caller's "unpaired
+// device" close is the one answer a stranger gets, exactly as before — but
+// each is its own log line first, because "a cert that does not verify" and
+// "a revoked device presenting the cert it was paired with" are different
+// events to whoever reads stderr.
+//
+// The cert names the device's key, not its holder: what proves the browser
+// holds the key is the IK handshake itself, whose first message cannot be
+// built without the static's private half. The cert is public by design (a
+// later stage publishes it in the relay's directory), so this check must
+// never treat possession of the blob as the credential — the key equality
+// against the handshake's own static is the line that keeps a stolen blob
+// worthless.
+func (t *Transport) admitByFleetCert(ch *channel, peerStatic, payload []byte) (crypto.Device, bool) {
+	if len(payload) == 0 {
+		// A pre-fleet browser, or one pinned to this machine directly. Not
+		// even a log line of its own: this is the ordinary unpaired refusal.
+		return crypto.Device{}, false
+	}
+	cert, err := fleet.VerifyDevice(t.cfg.FleetPub, payload)
+	if err != nil {
+		t.log.Warn("relay channel presented a handshake payload that is not a verifying fleet device cert",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic), "err", err)
+		return crypto.Device{}, false
+	}
+	if !bytes.Equal(cert.Device, peerStatic) {
+		// A verifying cert for some other key. The handshake proved the
+		// browser holds peerStatic; the fleet vouched for a different device
+		// entirely, and honouring the pair would let any holder of any
+		// published cert attach as themselves.
+		t.log.Warn("relay channel presented a fleet cert for a different key",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic), "certDevice", crypto.DeviceID(cert.Device))
+		return crypto.Device{}, false
+	}
+
+	// Signed is not the same as tame. The cert's name is authentic — the
+	// fleet vouched for it — and still arbitrary: the encoding bounds it at
+	// 512 bytes and permits newlines and control characters, while its
+	// destination is devices.json and a row on the Devices screen. So it goes
+	// through the normaliser the local pairing ceremony puts its own labels
+	// through (trimmed, 64 runes, never empty), rather than a second and
+	// laxer rule for names that happen to arrive over the fleet. An empty
+	// name — which the minting ceremony never records but the encoding
+	// allows — comes back as "unnamed device" from the same place.
+	name := daemon.DeviceLabel(cert.Name)
+	dev, err := t.devices.AddFromFleetCert(name, peerStatic, payload, time.Unix(cert.IAT, 0))
+	switch {
+	case errors.Is(err, crypto.ErrDeviceRevoked):
+		// The one rule with its own sentence in the spec: a revocation
+		// permanently outranks a device cert for the same key, whatever
+		// either one's iat says. The check lives inside the registry write —
+		// one critical section with the add — so a concurrent revoke cannot
+		// land between a check here and the write.
+		t.log.Warn("relay channel presented a fleet cert for a revoked key",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic))
+		return crypto.Device{}, false
+	case err != nil:
+		// The registry could not be read or written — the same refusal
+		// direction FindByKey's error takes, for the same reason.
+		t.log.Error("could not register a fleet-certified device",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic), "err", err)
+		return crypto.Device{}, false
+	}
+	t.log.Info("relay channel admitted a fleet-certified device",
+		"channel", ch.id, "device", dev.ID, "pairedOn", cert.PairedOn)
+	return dev, true
+}
+
 // handshake runs the Noise IK responder over this channel and returns the
-// initiator's static key with it — the device identity the caller authorises.
-func (t *Transport) handshake(s *socket, ch *channel) (*crypto.Channel, []byte, error) {
+// initiator's static key with it — the device identity the caller authorises
+// — and message A's decrypted payload, where a fleet device cert rides when
+// the initiator has one.
+func (t *Transport) handshake(s *socket, ch *channel) (*crypto.Channel, []byte, []byte, error) {
 	deadline := time.NewTimer(handshakeDeadline)
 	defer deadline.Stop()
 
diff --git a/internal/transport/relay/channel_test.go b/internal/transport/relay/channel_test.go
index e96fcf6..d28f74b 100644
--- a/internal/transport/relay/channel_test.go
+++ b/internal/transport/relay/channel_test.go
@@ -1,7 +1,9 @@
 package relay
 
 import (
+	"bytes"
 	"context"
+	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -17,6 +19,7 @@ import (
 	"github.com/flynn/noise"
 	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
@@ -34,13 +37,15 @@ const localToken = "0123456789abcdef"
 
 // --- fixtures ---
 
-// identity is a daemon's static key, its paired-device registry, and one
-// device already in it: the state a browser can actually attach against.
+// identity is a daemon's static key, its paired-device registry, one device
+// already in it, and a fleet key: the state a browser can actually attach
+// against.
 type identity struct {
 	key       noise.DHKey
 	devices   *crypto.DeviceStore
 	device    crypto.Device
 	deviceKey noise.DHKey
+	fleet     fleet.Key
 }
 
 func newIdentity(t *testing.T) *identity {
@@ -55,7 +60,7 @@ func newIdentity(t *testing.T) *identity {
 		t.Fatalf("GenerateKeypair: %v", err)
 	}
 	store := crypto.NewDeviceStore(dir)
-	dev, err := store.Add("phone", devKey.Public)
+	dev, err := store.Add("phone", devKey.Public, nil)
 	if err != nil {
 		t.Fatalf("Add: %v", err)
 	}
@@ -65,7 +70,22 @@ func newIdentity(t *testing.T) *identity {
 	if ok, err := store.UpdateLastSeen(dev.ID, time.Now().Add(-time.Hour)); err != nil || !ok {
 		t.Fatalf("backdating the device: %v, %v", ok, err)
 	}
-	return &identity{key: key, devices: store, device: dev, deviceKey: devKey}
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatalf("fleet.Mint: %v", err)
+	}
+	return &identity{key: key, devices: store, device: dev, deviceKey: devKey, fleet: fk}
+}
+
+// deviceCert signs a fleet device cert for key under id's fleet key, the way
+// a sibling machine's pairing ceremony would have.
+func (id *identity) deviceCert(t *testing.T, key []byte, name string) []byte {
+	t.Helper()
+	blob, err := id.fleet.Sign(fleet.DeviceCert{Device: key, Name: name, PairedOn: "sibling-mac-a1b2-0f9a12cd", IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatalf("signing a device cert: %v", err)
+	}
+	return blob
 }
 
 // unpairedKey is a browser key this daemon has never seen.
@@ -84,7 +104,7 @@ func newChannelTransport(t *testing.T, r *fakeRelay, srv Server, id *identity, l
 	if log == nil {
 		log = slog.New(slog.DiscardHandler)
 	}
-	tr, err := New(Config{URL: r.URL(), Secret: "s", Origin: testOrigin, MachineID: testMachineID}, srv, id.key, id.devices, log)
+	tr, err := New(Config{URL: r.URL(), Secret: "s", Origin: testOrigin, MachineID: testMachineID, FleetPub: id.fleet.Public()}, srv, id.key, id.devices, log)
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}
@@ -98,7 +118,7 @@ func newChannelTransport(t *testing.T, r *fakeRelay, srv Server, id *identity, l
 func newDaemonServer(t *testing.T, id *identity) (*daemon.Server, *httptest.Server) {
 	t.Helper()
 	srv := daemon.New(session.NewRegistry(time.Now), nil, nil, "test",
-		daemon.Identity{Key: id.key, Devices: id.devices})
+		daemon.Identity{Key: id.key, Devices: id.devices, Fleet: id.fleet})
 	t.Cleanup(srv.Shutdown)
 	ts := httptest.NewServer(srv.Handler())
 	t.Cleanup(ts.Close)
@@ -225,18 +245,25 @@ type browser struct {
 }
 
 // attach announces a channel the way the Worker does and completes the
-// handshake the browser drives.
+// handshake the browser drives, presenting no cert — the pre-fleet browser,
+// and the shape every existing test exercises.
 func attach(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub []byte) *browser {
+	return attachWithPayload(t, c, chanID, key, daemonPub, nil)
+}
+
+// attachWithPayload is attach with message A's encrypted payload — the
+// fleet device cert, or whatever bytes a test wants judged in its place.
+func attachWithPayload(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub, payload []byte) *browser {
 	t.Helper()
 	c.sendControl(t, relaywire.Open{Channel: chanID, Origin: testOrigin})
-	return handshake(t, c, chanID, key, daemonPub)
+	return handshake(t, c, chanID, key, daemonPub, payload)
 }
 
 // handshake drives the IK handshake on an already-announced channel.
-func handshake(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub []byte) *browser {
+func handshake(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub, payload []byte) *browser {
 	t.Helper()
 	b := &browser{t: t, c: c, id: chanID}
-	ch, err := crypto.InitiatorHandshake(key, daemonPub, nil, b.recvRaw, b.sendRaw)
+	ch, err := crypto.InitiatorHandshake(key, daemonPub, payload, nil, b.recvRaw, b.sendRaw)
 	if err != nil {
 		t.Fatalf("the browser could not complete the handshake on channel %d: %v", chanID, err)
 	}
@@ -447,6 +474,290 @@ func TestRelayChannelRefusesAnUnknownDeviceKey(t *testing.T) {
 	}
 }
 
+// TestRelayChannelAdmitsAFleetCertifiedDevice is the fleet key doing its
+// job (spec/fleet-trust.md): a device this machine never paired presents,
+// in its handshake payload, the device cert a sibling machine's ceremony
+// minted — and is served, and written into this machine's own registry
+// under the cert's name, cert attached, so the Devices screen shows it,
+// LastSeen works, and a later stage can publish the blob onward.
+func TestRelayChannelAdmitsAFleetCertifiedDevice(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv, _ := newDaemonServer(t, id)
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	stranger := unpairedKey(t)
+	cert := id.deviceCert(t, stranger.Public, "attic phone")
+	b := attachWithPayload(t, c, 1, stranger, id.key.Public, cert)
+
+	if w, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatalf("the fleet-certified device's first frame was %#v, want a welcome", w)
+	}
+	b.sendControl(wire.List{})
+	if s, ok := b.recvControl().(wire.Sessions); !ok {
+		t.Fatalf("list was answered with %#v, want sessions", s)
+	}
+
+	list, err := id.devices.List()
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 2 {
+		t.Fatalf("registry holds %d devices, want the paired one and the admitted one", len(list))
+	}
+	got, ok, err := id.devices.FindByKey(stranger.Public)
+	if err != nil || !ok {
+		t.Fatalf("the admitted device is not in the registry: %v, %v", ok, err)
+	}
+	if got.Label != "attic phone" {
+		t.Errorf("registry label = %q, want the cert's name", got.Label)
+	}
+	if !bytes.Equal(got.Cert, cert) {
+		t.Error("the registry entry does not carry the cert it was admitted on")
+	}
+}
+
+// TestRelayChannelNormalisesTheCertName: a fleet-signed name is authentic,
+// which is not the same as bounded. The cert encoding permits 512 bytes with
+// newlines and control characters in them, and the value's destination is
+// devices.json and a row on the Devices screen — so it goes through the same
+// normaliser a local ceremony's label does (daemon.DeviceLabel), and there is
+// one rule for what a device may be called however the name arrived.
+func TestRelayChannelNormalisesTheCertName(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv, _ := newDaemonServer(t, id)
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	long := unpairedKey(t)
+	// Padded with the whitespace a trim removes and 200 multibyte runes,
+	// which is well inside the encoding's 512-byte ceiling and well past the
+	// 64 runes a label may be.
+	b := attachWithPayload(t, c, 1, long, id.key.Public,
+		id.deviceCert(t, long.Public, "  \n"+strings.Repeat("é", 200)+"\n"))
+	if _, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatal("the fleet-certified device was not welcomed")
+	}
+	got, ok, err := id.devices.FindByKey(long.Public)
+	if err != nil || !ok {
+		t.Fatalf("the admitted device is not in the registry: %v, %v", ok, err)
+	}
+	if want := strings.Repeat("é", 64); got.Label != want {
+		t.Fatalf("registry label = %q (%d runes), want it trimmed and capped at 64", got.Label, len([]rune(got.Label)))
+	}
+
+	// And the empty name the encoding allows but no ceremony produces: the
+	// fallback comes from the same one place.
+	blank := unpairedKey(t)
+	b = attachWithPayload(t, c, 2, blank, id.key.Public, id.deviceCert(t, blank.Public, ""))
+	if _, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatal("the device with a blank cert name was not welcomed")
+	}
+	if got, _, _ := id.devices.FindByKey(blank.Public); got.Label != "unnamed device" {
+		t.Fatalf("registry label for a blank cert name = %q", got.Label)
+	}
+}
+
+// TestRelayChannelRefusesAFleetCertForADifferentKey: the cert is a public
+// artifact, so holding one proves nothing — the handshake's own static key
+// is what the initiator proved possession of, and the cert must name
+// exactly it.
+func TestRelayChannelRefusesAFleetCertForADifferentKey(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	sink := &syncBuffer{}
+	tr := newChannelTransport(t, r, srv, id, slog.New(slog.NewTextHandler(sink, nil)))
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	victim := unpairedKey(t)
+	thief := unpairedKey(t)
+	// A perfectly valid cert — for the victim's key, presented by a
+	// handshake run under the thief's.
+	stolen := id.deviceCert(t, victim.Public, "victim phone")
+	attachWithPayload(t, c, 1, thief, id.key.Public, stolen)
+
+	expectClose(t, c, 1)
+	waitForLog(t, sink, "different key")
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections on a stolen cert, want 0", n)
+	}
+	if _, ok, _ := id.devices.FindByKey(thief.Public); ok {
+		t.Fatal("the thief's key reached the registry")
+	}
+}
+
+// TestRelayChannelRefusesAForeignFleetsCert: a cert signed by some other
+// fleet's key — a hostile relay minting its own — verifies under nothing
+// this daemon trusts.
+func TestRelayChannelRefusesAForeignFleetsCert(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	sink := &syncBuffer{}
+	tr := newChannelTransport(t, r, srv, id, slog.New(slog.NewTextHandler(sink, nil)))
+	runTransport(t, tr)
+
+	otherFleet, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	stranger := unpairedKey(t)
+	foreign, err := otherFleet.Sign(fleet.DeviceCert{Device: stranger.Public, Name: "impostor", PairedOn: "x-a1b2-0f9a12cd", IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	c := r.accept(t)
+	attachWithPayload(t, c, 1, stranger, id.key.Public, foreign)
+
+	expectClose(t, c, 1)
+	waitForLog(t, sink, "not a verifying fleet device cert")
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections for a foreign fleet's cert, want 0", n)
+	}
+}
+
+// TestRelayChannelRefusesGarbageInThePayload: bytes that are not a cert at
+// all get the same close an unpaired key gets — the payload can never make
+// an outcome worse than sending nothing.
+func TestRelayChannelRefusesGarbageInThePayload(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	stranger := unpairedKey(t)
+	attachWithPayload(t, c, 1, stranger, id.key.Public, []byte("not a certificate"))
+
+	expectClose(t, c, 1)
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections for a garbage payload, want 0", n)
+	}
+	if !c.stillOpen() {
+		t.Fatal("refusing one channel took the whole socket down")
+	}
+}
+
+// TestRelayRevocationOutranksTheFleetCert is the spec's precedence rule end
+// to end: revoke a device on this machine's Devices flow, and its fleet
+// cert — minted after the revocation, even — no longer admits it. Time is
+// deliberately no part of the rule; un-revoking is pairing afresh under a
+// new key.
+func TestRelayRevocationOutranksTheFleetCert(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv, ts := newDaemonServer(t, id)
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	// Admit the device on its cert first, so the revoke below runs against
+	// a real fleet-admitted entry.
+	stranger := unpairedKey(t)
+	cert := id.deviceCert(t, stranger.Public, "attic phone")
+	b := attachWithPayload(t, c, 1, stranger, id.key.Public, cert)
+	if _, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatal("the fleet-certified device was not welcomed")
+	}
+
+	// The operator revokes it, from a local client, the way the Devices
+	// screen does.
+	laptop := dialLocal(t, ts)
+	writeLocalControl(t, laptop, wire.Hello{Ver: "test"})
+	writeLocalControl(t, laptop, wire.Revoke{DeviceID: crypto.DeviceID(stranger.Public)})
+	for {
+		if _, ok := b.recvControl().(wire.Revoked); ok {
+			expectClose(t, c, 1)
+			break
+		}
+	}
+
+	// The same cert — and a fresher one — must both be dead now.
+	fresher := id.deviceCert(t, stranger.Public, "attic phone, again")
+	for i, blob := range [][]byte{cert, fresher} {
+		ch := uint32(10 + i)
+		attachWithPayload(t, c, ch, stranger, id.key.Public, blob)
+		expectClose(t, c, ch)
+	}
+	if _, ok, _ := id.devices.FindByKey(stranger.Public); ok {
+		t.Fatal("the revoked device is back in the registry")
+	}
+	// And the revocation is on file, signed, for the directory stage to
+	// publish.
+	revs, err := id.devices.Revocations()
+	if err != nil || len(revs) != 1 {
+		t.Fatalf("Revocations = %d entries, %v; want the one record", len(revs), err)
+	}
+	if !bytes.Equal(revs[0].PublicKey, stranger.Public) {
+		t.Error("the revocation names a different key")
+	}
+	if _, err := fleet.Verify(id.fleet.Public(), revs[0].Cert); err != nil {
+		t.Errorf("the stored revocation does not verify under the fleet key: %v", err)
+	}
+}
+
+// TestRelayChannelRefusesARevokedKeyStillInTheRegistry pins the acceptance
+// rule's *first* branch against the one state that can produce this: a revoke
+// that recorded its signed revocation and then failed to remove the registry
+// entry. daemon.removeDevice writes the two in that order deliberately, on
+// the grounds that a revocation on file is what makes the key dead — and
+// while rule 1 was a registry lookup and nothing else, that grounds was
+// false. The entry alone let the key straight back in, and the operator's
+// revoke bought nothing at all until some later retry happened to land.
+func TestRelayChannelRefusesARevokedKeyStillInTheRegistry(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	sink := &syncBuffer{}
+	tr := newChannelTransport(t, r, srv, id, slog.New(slog.NewTextHandler(sink, nil)))
+	runTransport(t, tr)
+
+	// The half-completed revoke, assembled directly: the revocation lands and
+	// the paired entry is left exactly where it was, which is what a failed
+	// DeviceStore.Remove leaves behind.
+	blob, err := id.fleet.Sign(fleet.Revocation{Device: id.deviceKey.Public, IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := id.devices.AddRevocation(id.deviceKey.Public, blob); err != nil {
+		t.Fatalf("AddRevocation: %v", err)
+	}
+	list, err := id.devices.List()
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 1 || list[0].ID != id.device.ID {
+		t.Fatalf("registry = %+v; this test needs the revoked device still listed", list)
+	}
+
+	c := r.accept(t)
+	attach(t, c, 1, id.deviceKey, id.key.Public)
+
+	expectClose(t, c, 1)
+	waitForLog(t, sink, "unpaired device", crypto.DeviceID(id.deviceKey.Public))
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections for a revoked key, want 0", n)
+	}
+	if !c.stillOpen() {
+		t.Fatal("refusing one channel took the whole socket down")
+	}
+}
+
 // TestRelayChannelRefusesAForeignOrigin: the origin on an open is announced
 // rather than assumed precisely so it can be checked. A relay announcing an
 // origin this daemon did not dial is misconfigured or lying, and either way the
diff --git a/internal/transport/relay/relay.go b/internal/transport/relay/relay.go
index 4f3d507..80bb730 100644
--- a/internal/transport/relay/relay.go
+++ b/internal/transport/relay/relay.go
@@ -19,6 +19,7 @@ package relay
 
 import (
 	"context"
+	"crypto/ed25519"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -146,15 +147,26 @@ const (
 
 // Config is everything the adapter needs to reach a deployed relay.
 //
-// All four fields are required: where to dial, which machine's slot to dial
-// it as, what the dial presents, and the origin the relay serves browsers on.
-// The daemon and the Worker share one long-lived DAEMON_SECRET, set at deploy
-// time by `flue relay setup`.
+// All five fields are required: where to dial, which machine's slot to dial
+// it as, what the dial presents, the origin the relay serves browsers on,
+// and the fleet public key the acceptance rule verifies device certs under.
+// The daemon and the Worker share one long-lived DAEMON_SECRET, set at
+// deploy time by `flue relay setup`; the fleet key was minted beside it and
+// the Worker never sees either half of it.
 type Config struct {
 	URL       string // the bare relay address: wss://flue-relay.<sub>.workers.dev
 	Secret    string // the DAEMON_SECRET set at deploy time
 	Origin    string // https origin the relay serves the UI on
 	MachineID string // the machine's slot on the relay: the <id> of /daemon/<id>
+
+	// FleetPub is the fleet public key (spec/fleet-trust.md), derived from
+	// the seed relay.json carries. Required like the rest, deliberately: a
+	// relay.json without a fleet seed is from a flue that predates the key,
+	// and the honest answer is the re-join the operator is one printed line
+	// away from — not a transport that quietly serves rule 1 of the
+	// acceptance order and silently drops rule 2 (channel.go). Only the
+	// public half ever reaches this package.
+	FleetPub ed25519.PublicKey
 }
 
 // ErrIncompleteConfig is what New answers a Config it cannot dial with: a
@@ -290,6 +302,12 @@ func New(cfg Config, srv Server, identity noise.DHKey, devices *crypto.DeviceSto
 		// staring at a hand-edited relay.json needs to see which value the
 		// grammar refused.
 		return nil, fmt.Errorf("%w: machine id %q is not a valid slug", ErrIncompleteConfig, cfg.MachineID)
+	case len(cfg.FleetPub) != ed25519.PublicKeySize:
+		// The message names the way out because there is exactly one: the
+		// fleet key rides the join line, and a relay.json without one is
+		// from before it existed (spec/fleet-trust.md keeps no
+		// compatibility with those, deliberately).
+		return nil, fmt.Errorf("%w: no fleet key; re-run the join line printed by `flue relay setup` on this machine", ErrIncompleteConfig)
 	}
 	if log == nil {
 		log = slog.New(slog.DiscardHandler)
diff --git a/internal/transport/relay/relay_test.go b/internal/transport/relay/relay_test.go
index d4db5ae..e5b34cd 100644
--- a/internal/transport/relay/relay_test.go
+++ b/internal/transport/relay/relay_test.go
@@ -3,6 +3,7 @@ package relay
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"encoding/json"
 	"errors"
 	"log/slog"
@@ -17,6 +18,7 @@ import (
 	"github.com/coder/websocket"
 	"github.com/flynn/noise"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 )
 
@@ -125,11 +127,16 @@ func newTestTransport(t *testing.T, r *fakeRelay, secret string, log *slog.Logge
 	if log == nil {
 		log = slog.New(slog.DiscardHandler)
 	}
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 	tr, err := New(Config{
 		URL:       r.URL(),
 		Secret:    secret,
 		Origin:    "https://relay.example",
 		MachineID: testMachineID,
+		FleetPub:  fleetKey.Public(),
 	}, srv, noise.DHKey{}, nil, log)
 	if err != nil {
 		t.Fatalf("New: %v", err)
@@ -168,7 +175,11 @@ func runTransport(t *testing.T, tr *Transport) func() {
 
 func TestNewRefusesAnIncompleteConfig(t *testing.T) {
 	t.Parallel()
-	full := Config{URL: "wss://relay.example", Secret: "s3cr3t", Origin: "https://relay.example", MachineID: "karns-mbp-a1b2-0f9a12cd"}
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	full := Config{URL: "wss://relay.example", Secret: "s3cr3t", Origin: "https://relay.example", MachineID: "karns-mbp-a1b2-0f9a12cd", FleetPub: fleetKey.Public()}
 
 	// Origin is the one worth stating a reason for. It is what every announced
 	// open and every forwarded pair is checked against, so an empty one does
@@ -186,15 +197,21 @@ func TestNewRefusesAnIncompleteConfig(t *testing.T) {
 		name string
 		cfg  Config
 	}{
-		{"no URL", Config{Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID}},
-		{"no secret", Config{URL: full.URL, Origin: full.Origin, MachineID: full.MachineID}},
-		{"no origin", Config{URL: full.URL, Secret: full.Secret, MachineID: full.MachineID}},
-		{"no machine id", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin}},
+		{"no URL", Config{Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID, FleetPub: full.FleetPub}},
+		{"no secret", Config{URL: full.URL, Origin: full.Origin, MachineID: full.MachineID, FleetPub: full.FleetPub}},
+		{"no origin", Config{URL: full.URL, Secret: full.Secret, MachineID: full.MachineID, FleetPub: full.FleetPub}},
+		{"no machine id", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, FleetPub: full.FleetPub}},
+		// The pre-fleet relay.json: everything else present, no fleet key.
+		// Refused by design — spec/fleet-trust.md keeps no compatibility
+		// with files from before the key — and the error names the re-join
+		// as the way out (asserted below).
+		{"no fleet key", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID}},
+		{"a truncated fleet key", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID, FleetPub: full.FleetPub[:31]}},
 		{"nothing at all", Config{}},
-		{"a machine id with a capital", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac"}},
-		{"a machine id led by a dash", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "-a1b2-0f9a12cd"}},
-		{"a machine id without a MAC tag — the pre-tag mint", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "karns-mbp-a1b2"}},
-		{"a machine id past 63 characters", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: strings.Repeat("a", 55) + "-0f9a12cd"}},
+		{"a machine id with a capital", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac", FleetPub: full.FleetPub}},
+		{"a machine id led by a dash", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "-a1b2-0f9a12cd", FleetPub: full.FleetPub}},
+		{"a machine id without a MAC tag — the pre-tag mint", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "karns-mbp-a1b2", FleetPub: full.FleetPub}},
+		{"a machine id past 63 characters", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: strings.Repeat("a", 55) + "-0f9a12cd", FleetPub: full.FleetPub}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -233,12 +250,21 @@ func TestNewRefusesAnIncompleteConfig(t *testing.T) {
 
 	t.Run("the machine id grammar error names the fault and the value", func(t *testing.T) {
 		t.Parallel()
-		_, err := New(Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac"},
+		_, err := New(Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac", FleetPub: full.FleetPub},
 			&stubServer{}, noise.DHKey{}, nil, nil)
 		if err == nil || !strings.Contains(err.Error(), "not a valid slug") || !strings.Contains(err.Error(), "My-Mac") {
 			t.Fatalf("New with machine id \"My-Mac\" = %v, want an error quoting it as not a valid slug", err)
 		}
 	})
+
+	t.Run("the fleet key error names the way out", func(t *testing.T) {
+		t.Parallel()
+		_, err := New(Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID},
+			&stubServer{}, noise.DHKey{}, nil, nil)
+		if err == nil || !strings.Contains(err.Error(), "no fleet key") || !strings.Contains(err.Error(), "join line") {
+			t.Fatalf("New without a fleet key = %v, want an error naming the missing key and the re-join", err)
+		}
+	})
 }
 
 func TestTransportDialsTheRelayWithBearerAuth(t *testing.T) {
@@ -296,12 +322,17 @@ func TestTransportRefusesARedirectRatherThanFollowIt(t *testing.T) {
 	ts := httptest.NewServer(mux)
 	t.Cleanup(ts.Close)
 
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 	srv := &stubServer{}
 	tr, err := New(Config{
 		URL:       "ws" + strings.TrimPrefix(ts.URL, "http"),
 		Secret:    "s3cr3t",
 		Origin:    "https://relay.example",
 		MachineID: testMachineID,
+		FleetPub:  fleetKey.Public(),
 	}, srv, noise.DHKey{}, nil, slog.New(slog.DiscardHandler))
 	if err != nil {
 		t.Fatalf("New: %v", err)
diff --git a/site/src/routes/index.tsx b/site/src/routes/index.tsx
index 2feaf1f..5fac6c7 100644
--- a/site/src/routes/index.tsx
+++ b/site/src/routes/index.tsx
@@ -28,9 +28,10 @@ const RELAY_LINES = [
   ok('worker deployed: flue-relay'),
   ok('web app uploaded'),
   ok('reachable at https://flue-relay.you.workers.dev'),
-  ok('this machine joined as laptop (laptop-9f3a)'),
+  ok('fleet key minted (Cloudflare never sees it)'),
+  ok('this machine joined as laptop (laptop-9f3a-3f9a12cd)'),
   output('\n  to add another machine, run this on it:\n'),
-  output('    flue relay join wss://flue-relay.you.workers.dev --secret …'),
+  output('    flue relay join wss://flue-relay.you.workers.dev --secret … --fleet …'),
 ]
 
 const PROBLEMS = [
diff --git a/testdata/fleet/certs.json b/testdata/fleet/certs.json
new file mode 100644
index 0000000..188b7a1
--- /dev/null
+++ b/testdata/fleet/certs.json
@@ -0,0 +1,56 @@
+{
+  "seed": "R-mXeHSvx0lLijEv8xtUjiabsPfOxXZsPAqtFxzBgUQ",
+  "publicKeyHex": "d1d8f6e143d3e573c724c0307e80164dd5afdba8024b31842bb2fcc91c24b4a5",
+  "cases": [
+    {
+      "name": "machine",
+      "cert": {
+        "v": 1,
+        "kind": "machine",
+        "id": "karns-macbook-pro-a1b2-8ac6565b",
+        "name": "Karn's MacBook Pro",
+        "noiseHex": "3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe5264",
+        "iat": 1754700000
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f0101001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200124b61726e2773204d6163426f6f6b2050726f3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe526400000000689698e0",
+      "signedHex": "666c75652d666c6565742d636572742f0101001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200124b61726e2773204d6163426f6f6b2050726f3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe526400000000689698e071454830b705f1ffedf4d1866d0033014eef9a6314c28e70c96079bf36b4578191541963da8db11afdbbdfff67786955108a9f3dd1b1e76d67d85b458f1f3204"
+    },
+    {
+      "name": "device",
+      "cert": {
+        "v": 1,
+        "kind": "device",
+        "name": "relayed phone",
+        "deviceHex": "07c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411",
+        "pairedOn": "karns-macbook-pro-a1b2-8ac6565b",
+        "iat": 1754700001
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f010207c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411000d72656c617965642070686f6e65001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e1",
+      "signedHex": "666c75652d666c6565742d636572742f010207c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411000d72656c617965642070686f6e65001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e14df03dcd88034926d34caf1b19f349297f0b698a9b1edecb7f7921f64c9c80eab8dbed5a8f51414b8326cb556516adcae9d79d0b5fe7c11f5ceb32b892c1c306"
+    },
+    {
+      "name": "device-unicode-name",
+      "cert": {
+        "v": 1,
+        "kind": "device",
+        "name": "Karn’s téléphone 📱",
+        "deviceHex": "2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a",
+        "pairedOn": "karns-macbook-pro-a1b2-8ac6565b",
+        "iat": 1754700002
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f01022a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a00194b61726ee28099732074c3a96cc3a970686f6e6520f09f93b1001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e2",
+      "signedHex": "666c75652d666c6565742d636572742f01022a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a00194b61726ee28099732074c3a96cc3a970686f6e6520f09f93b1001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e2f37226ced92ca988be709c611b0eb3c9f1e4d729c4f7393aeaa3c47b507b0158acfa909f5eac71e5e9739c68be95120f50e17b0fe953f6f94794f8de86c0ef01"
+    },
+    {
+      "name": "revoke",
+      "cert": {
+        "v": 1,
+        "kind": "revoke",
+        "deviceHex": "07c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411",
+        "iat": 1754700003
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f010307c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e8941100000000689698e3",
+      "signedHex": "666c75652d666c6565742d636572742f010307c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e8941100000000689698e3dfff2c8c5dbd1b74e1352576c5c81b063d0729dfdcffc2f28fbb57c9edb10f640292471ece6ec7968c032326cb56c37f07b483dfc98ae423072950689c4e2204"
+    }
+  ]
+}
diff --git a/testdata/noise/ik-payload.json b/testdata/noise/ik-payload.json
new file mode 100644
index 0000000..865768b
--- /dev/null
+++ b/testdata/noise/ik-payload.json
@@ -0,0 +1,29 @@
+{
+  "protocol": "Noise_IK_25519_ChaChaPoly_SHA256",
+  "initiatorStaticPriv": "eeb8018a418c7baa11d09080d32dbf5585ed4cd6ac7173f191d56faa549d27aa",
+  "initiatorStaticPub": "07c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411",
+  "responderStaticPriv": "f8cf66818e3ca7684be962dae330e59496ea79172703dcc7c28403be3bb93d38",
+  "responderStaticPub": "3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe5264",
+  "initiatorEphemeralPriv": "5b2b914d878bebf3a3ec6963845493b5cbfb7bf5301913dc2a9b1f1231f75d9e",
+  "responderEphemeralPriv": "26ed0d6b19cb381c8539fec74451409482967797e732b9c1a83d319ece1d3ab1",
+  "msg1": "7aa6099ce801ab46076749db6a77e2f90b3f2c35209c8154a7bff1af5179ae224874140da11f5e15535c9c8089837e81ee177e3ec6e517b300974e967963579d6c57c00bfec57a32d4eec862f94e20d213f4645cb7e2f3aebf9824df283f1dfebb37939272d2f352901c79524569897ce90ea4eab09aa39ec147cfb30ac4a7ad73b7ca58b76e53a18bf373d5237b87d1090920119e5c0aaf21691c53a9d8d62cb02e365156721ddea09fcc295dc831b5fb1d28bc4c6429671368fa38dc20eb60b3958e59ed004a20038ab8347a50e23e4515bf0d01d8e26fd82cf454421052229234fbde80756b1784c963e2d4e6fa1a57f19135d87ea41a634107f016eaba862b32c6d01a24ddde4967",
+  "msg2": "4801aff0ca8541e9e8164469cbb2df576575cde958f048d5e4ff431e4c2de116d6179eb365e654d8c0da4de0285cc258",
+  "transport": [
+    {
+      "dir": "i2r",
+      "plaintext": "68656c6c6f206461656d6f6e",
+      "ciphertext": "2adcd61521379c1e5c1d5ba4b4e0d47d33bed85a6291ea1c91954d64"
+    },
+    {
+      "dir": "r2i",
+      "plaintext": "68656c6c6f2062726f77736572",
+      "ciphertext": "8b8933ece3142387fcaa13d8640348f595e85e77ab3a1988a2796cae21"
+    },
+    {
+      "dir": "i2r",
+      "plaintext": "",
+      "ciphertext": "44d055608856577705078fa7225e5cf7"
+    }
+  ],
+  "msg1Payload": "666c75652d666c6565742d636572742f010207c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411000d72656c617965642070686f6e65001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e14df03dcd88034926d34caf1b19f349297f0b698a9b1edecb7f7921f64c9c80eab8dbed5a8f51414b8326cb556516adcae9d79d0b5fe7c11f5ceb32b892c1c306"
+}
diff --git a/web/src/components/cloudflare-connect.test.tsx b/web/src/components/cloudflare-connect.test.tsx
index df421ff..3aef0cf 100644
--- a/web/src/components/cloudflare-connect.test.tsx
+++ b/web/src/components/cloudflare-connect.test.tsx
@@ -61,7 +61,7 @@ describe('CloudflareConnectCard', () => {
       {
         steps: ['token verified', 'worker deployed: flue-relay', 'secret set'],
         origin: 'https://flue-relay.karn.workers.dev',
-        join_command: 'flue relay join wss://flue-relay.karn.workers.dev --secret s3cret',
+        join_command: 'flue relay join wss://flue-relay.karn.workers.dev --secret s3cret --fleet fl33t',
       },
     ])
     render(<CloudflareConnectCard info={INFO} setupCommand="flue relay setup" />)
@@ -76,7 +76,7 @@ describe('CloudflareConnectCard', () => {
     expect(await screen.findByText('worker deployed: flue-relay')).toBeTruthy()
     expect(screen.getByText(/To add another machine/)).toBeTruthy()
     expect(
-      screen.getByText('flue relay join wss://flue-relay.karn.workers.dev --secret s3cret'),
+      screen.getByText('flue relay join wss://flue-relay.karn.workers.dev --secret s3cret --fleet fl33t'),
     ).toBeTruthy()
     expect(screen.getByText(/also available from this screen later/)).toBeTruthy()
     // The form is gone: the flow is over and the token state was cleared.
diff --git a/web/src/components/cloudflare-connect.tsx b/web/src/components/cloudflare-connect.tsx
index e2794a0..9deb378 100644
--- a/web/src/components/cloudflare-connect.tsx
+++ b/web/src/components/cloudflare-connect.tsx
@@ -45,6 +45,12 @@ const TOKEN_PAGE = 'https://dash.cloudflare.com/profile/api-tokens'
 /** GET /api/relay/info, verbatim (daemon.RelayUIStatus). */
 export interface RelayUIInfo {
   configured: boolean
+  /**
+   * The faults that stop this daemon dialling the relay.json it has, in the
+   * daemon's own words — the same list `flue status` prints. Empty or absent
+   * when the file is one the transport accepts.
+   */
+  problems?: string[]
   origin?: string
   worker?: string
   can_deploy: boolean
@@ -632,12 +638,14 @@ function AddressChange({ origin }: { origin?: string }) {
 /**
  * The join line for adding another machine, behind a click.
  *
- * Behind a click and not on the page, because it carries the fleet secret:
- * the daemon will hand it to this authenticated loopback page whenever asked
- * (/api/relay/join rebuilds it from relay.json), but a secret should cross
- * onto a screen at the moment a human asked to see it, not on every visit.
- * Never rendered on a relay origin: the endpoint does not exist there, and
- * the secret must not be offered to a remote tab.
+ * Behind a click and not on the page, because it carries both of the relay's
+ * credentials — the daemon secret the Worker also holds, and the fleet key
+ * that nothing outside your own machines ever holds. The daemon will hand
+ * the line to this authenticated loopback page whenever asked
+ * (/api/relay/join rebuilds it from relay.json), but a credential should
+ * cross onto a screen at the moment a human asked to see it, not on every
+ * visit. Never rendered on a relay origin: the endpoint does not exist
+ * there, and neither credential may be offered to a remote tab.
  */
 export function JoinReveal() {
   const [cmd, setCmd] = useState('')
@@ -661,8 +669,9 @@ export function JoinReveal() {
     return (
       <div className="flex flex-col gap-y-1.5">
         <p className={NOTE}>
-          Run this on another machine to add it — it carries the relay's secret, so treat it like
-          one:
+          Run this on another machine to add it. It carries the relay's secret and the fleet key
+          that every machine here trusts, so anyone who gets the line gets the fleet — paste it into
+          a terminal, not into anything that keeps history:
         </p>
         <Copyable text={cmd} />
       </div>
diff --git a/web/src/routes/remote.test.tsx b/web/src/routes/remote.test.tsx
index d0da3cb..dbddaa1 100644
--- a/web/src/routes/remote.test.tsx
+++ b/web/src/routes/remote.test.tsx
@@ -116,6 +116,42 @@ describe('RemoteRoute', () => {
     expect(screen.getByText(SETUP)).toBeTruthy()
   })
 
+  it('separates a relay it will not dial from having no relay, and names the fault', async () => {
+    // The transport reports `off` for both "no relay configured" and "a
+    // relay.json this daemon refuses" — so the second rendered as the first:
+    // a badge saying nothing was set up and a paragraph of setup instructions,
+    // on a machine whose relay had just stopped working. The upgrade that
+    // produces it is silent otherwise (a relay.json from before the fleet key
+    // carries no seed, and relay.New refuses that), so the daemon names each
+    // fault on /api/relay/info and this screen repeats it.
+    const info = {
+      configured: true,
+      problems: ['no fleet key'],
+      can_deploy: true,
+      version: 'v',
+    }
+    const fetchImpl = vi.fn(
+      async () =>
+        new Response(JSON.stringify(info), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        }),
+    )
+    vi.stubGlobal('fetch', fetchImpl)
+    try {
+      await mountRemote()
+
+      expect(await screen.findByText('Not usable')).toBeTruthy()
+      expect(screen.queryByText('Not configured')).toBeNull()
+      // The daemon's word for it, verbatim, and the command that says the
+      // same thing in a terminal.
+      expect(screen.getByText(/no fleet key/)).toBeTruthy()
+      expect(screen.getByText(STATUS)).toBeTruthy()
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
   it('copies the address the relay carries this machine at', async () => {
     // Copyable for the same reason the commands are: this is a string somebody
     // sends to themselves, and it is longer than a phone is wide.
@@ -264,7 +300,7 @@ describe('JoinReveal', () => {
       const body =
         url === '/api/relay/info'
           ? { configured: true, can_deploy: true, version: 'v', worker: 'flue-relay' }
-          : { join_command: 'flue relay join wss://r --secret s' }
+          : { join_command: 'flue relay join wss://r --secret s --fleet f' }
       return new Response(JSON.stringify(body), {
         status: 200,
         headers: { 'Content-Type': 'application/json' },
@@ -282,7 +318,7 @@ describe('JoinReveal', () => {
 
       await user.click(await screen.findByRole('button', { name: 'Show the join command' }))
 
-      expect(await screen.findByText('flue relay join wss://r --secret s')).toBeTruthy()
+      expect(await screen.findByText('flue relay join wss://r --secret s --fleet f')).toBeTruthy()
       expect(fetchImpl.mock.calls.map((c) => String(c[0]))).toContain('/api/relay/join')
     } finally {
       vi.unstubAllGlobals()
diff --git a/web/src/routes/remote.tsx b/web/src/routes/remote.tsx
index 91406d5..222489d 100644
--- a/web/src/routes/remote.tsx
+++ b/web/src/routes/remote.tsx
@@ -65,8 +65,19 @@ function connectionNotice(status: ConnStatus): string | null {
  * and `client.relay` folds that into the same `{status:'off'}` a daemon with no
  * relay sends. Rendering "Not configured" from it would put the loudest claim
  * on this screen on the page before anything had said it.
+ *
+ * `unusable` splits the last of those: the transport says `off` both for a
+ * machine that never had a relay and for one whose relay.json the daemon
+ * refuses to dial, and calling the second "Not configured" is how an upgrade
+ * that ended remote access reads as a machine that never set it up.
  */
-function StatusBadge({ status }: { status: RelayInfo['status'] | null }) {
+function StatusBadge({
+  status,
+  unusable,
+}: {
+  status: RelayInfo['status'] | null
+  unusable?: boolean
+}) {
   if (status === null) {
     return (
       <Badge variant="outline" className="shrink-0">
@@ -93,6 +104,13 @@ function StatusBadge({ status }: { status: RelayInfo['status'] | null }) {
       </Badge>
     )
   }
+  if (unusable) {
+    return (
+      <Badge variant="outline" className="shrink-0">
+        Not usable
+      </Badge>
+    )
+  }
   return (
     <Badge variant="outline" className="shrink-0">
       Not configured
@@ -188,6 +206,49 @@ function NotConfigured({ info }: { info: RelayUIInfo | null }) {
   )
 }
 
+/**
+ * A relay this machine has a configuration file for and will not dial.
+ *
+ * The state the screen used to swallow. relay.json exists and parses, so the
+ * daemon calls itself configured; the transport refuses the file, so no socket
+ * is ever opened and the welcome reports `off` — the same word a machine that
+ * never had a relay gets. The commonest way in is an upgrade: a relay.json
+ * written before the fleet key existed carries no fleet seed, and the fleet
+ * key is not optional (spec/fleet-trust.md).
+ *
+ * The faults are repeated in the daemon's own words rather than paraphrased.
+ * They are the strings `flue status` prints (relayProblems in
+ * cmd/flue/main.go), and a second wording for the same fact is one more thing
+ * that can drift away from it.
+ */
+function Unusable({ info }: { info: RelayUIInfo }) {
+  return (
+    <>
+      <StatePanel
+        icon={GlobeAltIcon}
+        title="This machine will not dial the relay it is configured for"
+      >
+        <p className={cn(PROSE, 'max-w-[65ch]')}>
+          The daemon found a relay configured here and refuses it — {(info.problems ?? []).join(', ')}{' '}
+          — so nothing outside this computer can reach these sessions, and pairing a device stays
+          shut.
+        </p>
+        <p className={cn(PROSE, 'max-w-[65ch]')}>
+          Running the join line on this machine, from a machine already on the relay, writes a
+          complete configuration and costs nothing else. Deploying below replaces the relay
+          entirely — a fresh secret and a fresh fleet key — which every other machine then has to
+          re-join and every paired browser has to pair again.
+        </p>
+        <Command command={STATUS_COMMAND} />
+      </StatePanel>
+
+      <Integrations>
+        <CloudflareConnectCard info={info} setupCommand={SETUP_COMMAND} />
+      </Integrations>
+    </>
+  )
+}
+
 /**
  * A relay this daemon is configured for and cannot reach yet.
  *
@@ -348,6 +409,17 @@ export function RemoteRoute() {
   const status: RelayInfo['status'] =
     relay.status === 'connected' && origin === '' ? 'connecting' : relay.status
 
+  /*
+   * Whether the daemon is refusing a relay.json it has, rather than having
+   * none. The transport cannot tell the two apart — both are `off` on the
+   * welcome — so the fact comes from the daemon's own answer about its config
+   * file, which names each fault (`problems` on /api/relay/info). Null while
+   * that answer is on its way, and on a relay origin where it is never asked
+   * for; both read as false, which keeps this to the loopback screen it is
+   * about.
+   */
+  const unusable = Boolean(relayUI?.configured && relayUI.problems?.length)
+
   return (
     /*
       The cap moves up here from the panels inside it, which each carried
@@ -364,7 +436,7 @@ export function RemoteRoute() {
       */}
       <PageHeader
         crumbs={[{ label: 'Remote access' }]}
-        actions={<StatusBadge status={greeted ? status : null} />}
+        actions={<StatusBadge status={greeted ? status : null} unusable={unusable} />}
       >
         <p className={cn(PROSE, 'max-w-[65ch]')}>
           The daemon listens on this computer and nowhere else. A relay gives it an address the
@@ -384,7 +456,8 @@ export function RemoteRoute() {
       </PageHeader>
 
       {!greeted && <AwaitingWelcome connecting={conn === 'connecting'} />}
-      {greeted && status === 'off' && <NotConfigured info={relayUI} />}
+      {greeted && status === 'off' && unusable && relayUI && <Unusable info={relayUI} />}
+      {greeted && status === 'off' && !unusable && <NotConfigured info={relayUI} />}
       {greeted && status === 'connecting' && <Dialling />}
       {greeted && status === 'connected' && (
         <>