New publishers can introduce themselves at any time by simply publishing a catalogue, making it available for download, and providing out-of-band mechanisms for verifying the initial public key. This, however, replicates the effort required for out-of-band verification.

A simpler solution, which we have implemented, is to designate a special publisher (known as `Wax-Root') whose sole function is to introduce new publishers. Each Wax-Root catalogue assigns one (or exceptionally more than one) of the 7 public keys to the new publisher's first catalogue, and in this way we branch the authentication tree.