A trusted address can outlive the agent it was added for, and nothing in this design notices. Entries are exact https URIs with no expiry, so the weekend VPS someone retires next spring stays on the list. If its hostname was a CNAME to a cloud resource that later gets released, whoever claims that resource controls the callback. They can register a client with that exact URI and send the user an authorize link, and the consent screen will say the user trusted this address themselves. The typed-host step never comes up, because the address is already trusted.

I'd record the last successful code exchange for each trusted address and show it on the MCP page, then expire entries unused for, say, 90 days, with the same email you send on an addition. Re-trusting costs one typed host, which is cheap next to an entry that changed owners without anyone noticing.