diff --git a/schema/trace-v0.2.json b/schema/trace-v0.2.json
index 7228b99..cbf796d 100644
--- a/schema/trace-v0.2.json
+++ b/schema/trace-v0.2.json
@@ -61,8 +61,8 @@
     },
     "subject": {
       "type": "string",
-      "description": "Workload identity as a SPIFFE SVID URI or DID URI.",
-      "pattern": "^(spiffe://|did:)"
+      "description": "Workload identity as a SPIFFE SVID URI or DID URI. A SPIFFE ID carries a trust domain and a workload path within it; a DID carries a lowercase method name, per DID Core section 3.1, and a method-specific identifier. A prefix alone is not an identity: spiffe://example.org names a trust domain and no workload.",
+      "pattern": "^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$"
     },
     "model": {
       "type": "object",
@@ -119,7 +119,7 @@
             "tpm2",
             "software-only"
           ],
-          "description": "Hardware platform providing the root of trust. software-only marks development-mode records with no hardware backing; they must never be treated as attested evidence."
+          "description": "Hardware platform providing the root of trust. software-only marks records with no hardware root of trust, for example a development-mode execution, or a record assembled from evidence produced outside the runtime (origin.kind other than self requires this value; see spec 3.1.1). Such records must never be treated as attested evidence."
         },
         "measurement": {
           "type": "string",
@@ -472,6 +472,46 @@
               }
             }
           ],
+          "not": {
+            "anyOf": [
+              {
+                "required": [
+                  "d"
+                ]
+              },
+              {
+                "required": [
+                  "p"
+                ]
+              },
+              {
+                "required": [
+                  "q"
+                ]
+              },
+              {
+                "required": [
+                  "dp"
+                ]
+              },
+              {
+                "required": [
+                  "dq"
+                ]
+              },
+              {
+                "required": [
+                  "qi"
+                ]
+              },
+              {
+                "required": [
+                  "k"
+                ]
+              }
+            ]
+          },
+          "$comment": "RFC 8747 defines cnf as a confirmation key: the public half, present so a verifier can bind the record to the key that signed it. A private member here publishes the signing key inside the signed, self-authenticating, typically anchored record, and the only remedy afterwards is to revoke the identity. Mirrors _JWK_PRIVATE_PARAMS in the reference model, which already refuses these.",
           "additionalProperties": {
             "$ref": "#/$defs/canonicalizableValue"
           }