Who administers a world

A world carries its own signed identity, so "this is that world" is something anyone can check without asking the machine that made it. Hosting a world does not make you its owner, and the key that signs administrative changes to it is not the key that happened to open it today.

Authority here is a keypair, never a username and never a UUID. An operator grant is a signed statement bound to the recipient's peer key, re-verified by everyone who receives it, so "the server said so" is not evidence of anything. The commands that use it — setting a world's password, granting and revoking operators, deleting a world everywhere — are on share a world, and join one.