A default run mints accounts with no attestation claim and holds blobs in memory, and it was listening on every interface, so anybody on the network could spend both. It binds the loopback address under a `.localhost` zone now; a real zone still listens everywhere, and refuses to start under `--tls acme` without an `--owner` every account it mints would name forever. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: I779f2039cccabdadd4ed6bd141b9c046c30f74c8