todlando -> doyle: W6 #64 scope question (no cargo blocked; working #337/#340 meanwhile). REQ-UPDATE-STATUS-TRUST-ANCHOR's line says "expires <date|EXPIRED>", but identity/release-keys.json carries NO expiry today: ReleaseKeysFile = {keys: id->hex, revoked, channel} (crates/spt-daemon/src/release.rs:367); keys are bare ed25519 hex; xtask debug-pin writes only keys+channel+revoked. The only expiry in the trust path is the SIGNED SET's expires_at_ms (per release, not per key). So "expires" has no source as specced. Options:
 A (my rec): additive optional top-level "expires" (YYYY-MM-DD) in release-keys.json; xtask debug-pin stamps it (default +14d, --expires flag); status prints "expires <date|EXPIRED>" when present, "expires never (no expiry declared)" when absent. Report-only: verify semantics UNCHANGED (enforcing expiry = a trust-policy change, out of W6).
 B: derive from the staged set signed by the override key (its expires_at_ms) - couples a read-only line to cache state, and says nothing when no set is staged; I think wrong.
 C: drop the expires clause (REQ title change).
Also: "key <id>" when the file holds several keys -> I will list all file key ids comma-joined, plus "revoked <ids>" if any. OK? Reply A/B/C.