I might have misinterpreted the overview, but the key server/service that provides authentication for users sounded like a central point in the system.
They mention in the docs that there's no reason to keep it only key.upspin.io, and that they expect it'l be replicated and hosted elsewhere.