Withdraws trust. The declaration leaves the trust set on the very next request and
its issuer URL becomes declarable again.

🔴 Refused with 409 while any actor binding still depends on

it, and the refusal names how many. There is deliberately no cascade: a cascade
would delete, in one unremarkable-looking DELETE, the entire authentication path of
every workload bound to that issuer — at a moment the operator was tidying a
registry rather than one they had chosen to cut those workloads off. Remove the
bindings first, or disable the issuer instead, which stops it being
trusted immediately and keeps everything.

Nothing withdraws trust on a timer. There is no sweep, no grace window and

no automatic suspension anywhere in this feature. A schedule that cut a customer's
production authentication N days after a billing event would do it at a moment no
operator chose and with no human in the loop.

Ungated, like disable: reducing your own exposure is never

something a billing state should block.