docs: signing what is sent, and which --sign-every to choose

api.md's Signed changes says what sent, all and none do, what each
costs, and which to choose: sent for nearly every swarm, all where each
change should carry its own proof, none to save signatures where only
protocol data and listed paths need them; and that signatures travel
with their changes, a message carrying none taking none. access.md no
longer says signatures come on their own within a second.

1 files changed, 3 insertions, 3 deletions

diff --git a/docs/access.md b/docs/access.md
index 4c41e3d..2df7270 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -276,9 +276,9 @@ through (they look at the path asked for, the rules at everything the change doe
 can't cut its node off.
 
 With `"signatures": "required"`, a change also needs a signature by the node it names
-([`api.md`](api.md), Signed changes): every node then signs every change it makes, and
-one no signature vouches for yet waits, with whatever builds on it, until one does
-(they come with the changes, or within a second on their own). A signature vouches for
+([`api.md`](api.md), Signed changes): every node then signs what it sends, so every
+change leaves vouched for, and one no signature vouches for yet waits, with whatever builds on it, until one does
+(they come with the changes, in the same sync messages). A signature vouches for
 its change and the node's changes it builds on, no others: a change made under another
 node's actor is forged, refused, and logged as its sender's (`A peer brought changes
 forged`). A member can then no longer write as another member; the user a change names is still its node's word.