trace-and-revoke