Record SSH-signed keychain init ops

README.md

@@ -27,6 +27,13 @@ registry, module router, local metadata store, and synchronized data structures.
 Most non-daemon commands talk to the daemon through a local Unix socket at
 `$GETH_HOME/run/geth.sock`.
 
+`geth keychain init --admin-key <public-key> --signing-key <private-key>` records
+the keychain initialization/admin-key operations and signs their canonical
+payloads through `ssh-keygen -Y sign` using the
+`geth.keychain.v1@geth.local` namespace. This is the bootstrap path for
+admin/YubiKey-rooted trust; signature verification for replicated keychain ops is
+still future work.
+
 The daemon can also install itself as a user service:
 
 ```sh
@@ -82,7 +89,7 @@ The bootstrap implementation provides:
 - `geth peer auth-check <node-id> <resource> <capability>`
 - `geth resource list`
 - `geth resource create <kind> <name>`
-- `geth keychain init [--admin-key <path>]`
+- `geth keychain init [--admin-key <path>] [--signing-key <path>]`
 - `geth keychain status`
 - `geth secret status`
 - `geth secret create <resource>`