New flow: register -> OpRegister(pubKey) -> OpIdentity(number+cert). Reconnect: OpGetChallenge -> OpAuthCert(cert+sig). PoW eliminated from client flow.