How it works
Deletion, inside a ledger that cannot be edited
An append-only spine and a real erasure obligation are not usually compatible. Here they are.
Personal data is sealed on the way in under a per-subject key; destroying that key is the deletion, and it is immediate, per-subject and provable. The certificate enumerates what was destroyed AND what deliberately survives — the financial skeleton a trustee needs — rather than implying the remainder is not there.