Add prototype encrypted CAS blobs

README.md

@@ -110,6 +110,10 @@ The bootstrap implementation provides:
 - local filesystem CAS commands: `add`, `get`, `fetch`, `hash`, `has`, `pin`,
   `unpin`, `cleanup`, `providers`, `list`; remote fetch accepts
   `--bearer-secret <secret>`
+- private CAS envelope commands:
+  `geth cas add-private <resource> <path>` and
+  `geth cas get-private <resource> <hash> --out <path>`. These use local
+  resource secret epochs and are a prototype envelope, not audited AEAD.
 - local CAS tree objects describe file trees and are stored as CAS blobs
 - local file-root commands: `geth cas root add/list/scan/sync/apply`; root sync
   pulls authorized remote tree metadata and CAS tree bytes into a peer-qualified