Partition attack on client knowledge (2)

Directory servers can be out of sync; evil directory servers can give out rigged subsets to trace clients.

Fix: DSs must successively sign directory bundles; a threshold of servers is assumed good.

What do users do if the DSs can't agree?