What I mean is that if Bob hands his capability to Carol, she can give it to Dave and he can't stop it.
I don't see any reason we need keys here.
I don't see any reason we need keys here.
One of the more complex aspects of OCAPy design vs the we do things now is that in a fully ocap world, the token wouldn't just be a string, but possibly a reference to a living object that Alice owns.
Then the trade (and any use of the capability) always goes through Alice.
That's why you don't need crypto in a real OCAP world.