Nice concept, the offline provisioning is the part that stands out to me vs Tailscale. How does revocation work in that model? Didn't see it in the docs, if a laptop with a .peer profile gets stolen, what then?