> > What prevents a client providing some authInfo from also attempting to set > > upID and set or modify upDate? > > the updated date and last-modified date are managed by the registry. You mean that the sponsoring client can't set upID or set or modify upDate? I didn't know that.