Sealed sender

Sealed sender hides the sender's ordinary account identity from the delivery request while preserving authorization. The SDK uses the existing signed sender-certificate schema with required Relay scope and issuer validity.

Hosted and self-hosted sealed sender use the same required certificate shape. They use disjoint operator-owned roots, issuers, scopes, and revocation policy. A managed certificate cannot validate under a self-hosted root, and a self-hosted certificate cannot validate under a managed root.

Relay accepts only a current scoped certificate and a valid anonymous-delivery capability. It rejects an old unscoped certificate. Rotation uses an explicit overlap window, and revocation closes the affected scope without exposing private signing material to the request path.

Identified delivery does not require a sender certificate. When the application permits fallback, the SDK can retry identified delivery only after the exact anonymous authorization rejection defined by its policy. Network errors and generic server failures do not cause a privacy-changing fallback.