#[KevinMarks]The delete then recreate case is worth documenting as a possible AP spec issue, as if implementations treat delete as irrevocable that sounds like an attack vector. I can't work out all the implications, but it may be a way to disrupt account migration too