A handle looks like a name. Underneath it is a DID, and the DID document is held shut by rotation keys: whoever holds one can move the account to another server, change its handle, or swap its signing key. Type a name and see who that is, and every time it changed.
Rotation keys are listed in priority order; a higher key can override a recent change made by a lower one (for 72 hours). On most accounts the first key belongs to the hosting server, not to the person. That's an arrangement, not a law: anyone can add their own key above it, if the server lets them.
The PDS is the server that keeps the account's posts. The handle is a claim the DID makes and the domain has to confirm.
Only did:plc identities have a public history here. A did:web identity is held by whoever controls that domain's web server, so there's no log to show.
This page asks public.api.bsky.app to turn a handle into a DID and plc.directory for the history. It stores nothing.