You are correct - anyone with the address & ABI can call a public contract. The only way to prevent this is to have code within the contract that checks for calls from authorized addresses.
If a private key is lost then the contract would need to be updated to replace that authorized address.
I suggest you take a look at Quorum's smart contract based ...
Azure provides an RPC security layer that enforces access control to the network. In order to provide authentication to your RPC interface you can use basic authentication, certificate based authentication or you can link to your identity provider.
After you are part of the network (rpc auth passe) you have Quorum state authorization layer (what is called ...
If your node changes a block, the hash of that block changes and probably the state root.
A few things happen.
Every block after is invalid. You would need to remine them all.
The blocks your node receives from others would appear invalid and blocks your node sends would appear invalid to them. It's a fork unless all nodes agree.
The threshold for ...
This depends on your requirements, and can't be answered simply. To help guide your thinking, I'd suggest:
1) Is a blockchain really needed?
You have said you are new to this space, so perhaps review your requirement against the charts here:
2) Public or Consortium
Anything in config section of genesis is applied directly onto the geth regardless of the blocks it may have already in its chain. So, if the chain is up to lets say block 1000, you can enable new hard forks such as constantinople or istanbul by setting your constantinopleBlock to 1100 and then istanbulBlock to 1200 and it will work.
That said, some caveats:...
PoA networks do not natively have rewards baked into the consensus. There are instances where these are created with smart contracts that make system calls (see Energy Web Chain and POS_DAO) , but if you run clique natively there will be no block rewards.
Energy Web Chain - System Contracts - Rewards Contract