There were 2 checks in assert_valid_did_document_for_service that required keys held by the PDS to be in the user's DID record rotationKeys field:
- Server-wide rotation key. This is in the bsky reference implementation, removal proposed here: https://github.com/bluesky-social/atproto/issues/4819
- User-specific signing key (introduced in commit 28f2e04)
This blocked activation, and may also have affected account status checks.
This PR removes this requirement, allowing users to self-custody their rotation keys rather than trusting the PDS with it. This isn't something that's been commonly done until now but it's a core part of the promise of ATProto that you can control your own identity.
Without this change it's still possible to get your account in a state where the PDS doesn't control your ID but it requires a workaround where you put its keys into your ID, activate the account and then remove them again, which reduces your security.