Provenance and freshness
Every entry is declared, observed or derived. Declared entries supersede observed ones for the same
key. Entries not confirmed within the domain's freshness window, 365 days by default and 90 for
safety-critical keys, are returned with stale: true.