SIGNERS & WRITABLE FLAGS

The runtime tracks two facts per account in a transaction: is_signer (did its private key sign the tx) and is_writable (may the program mutate it). A program that reads authority.key() without checking authority.is_signer has only learned who the caller CLAIMS is authority. Signatures are how Solana says "this human agreed" — everything else is just bytes anyone can pass.