it's DIDs in DNS. you can read more here: https://atproto.com/guides/identity

so, your DID (which includes a pubkey) is actually your identity, and you can change your handle without changing your DID.

It doesn't exactly say it on the page i linked, but iiuc their plan is also that while today handles are all names ending with ICANN TLDs in the future they could also be under alternative TLDs defined by ✨blockchains✨.