Embargo

An embargoed path is encrypted to everyone until a reveal timestamp. You can merge a security fix, cut the release, and push — the relay holds the ciphertext while withholding the key until reveal_at passes on the relay's own clock. Then anyone who pulls can read it. No lying clock, escrow inspection, or patched binary reads it early: the key bytes simply aren't there yet.