users: a user manages its own keys

Only a user who may manage users could change a user's keys: a user
couldn't add a new laptop's key, or remove a lost one.

A user now manages its own keys, whatever else it may do:

* GET /auth/keys: its keys, its entry, and the envelope holding it
  under a strict policy (`signed`), to sign against.
* PUT /auth/keys/{id} with an authorized_keys line, DELETE
  /auth/keys/{id}: one change, as the user. The rules take a write of
  _continuum/users/<name>/keys/… from the user it names.
* Under a strict policy, the user signs its entry with only its keys
  changed, with a key it holds already (envelope::check takes that from
  the user itself), PUT to its own entry even without write on the
  registry; continuum-signed key-add and key-remove do so.

1 files changed, 6 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 3541efd..5983c7c 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -31,7 +31,12 @@ password hashes: every member reads the document).
   doesn't read is left out, and anything but `false` disables.
 * **`keys`**: the user's SSH keys, each by a name of its choosing, as an
   `authorized_keys` line has it (`"laptop": "ssh-ed25519 AAAA…"`; Ed25519 only): what
-  it signs values with (Values signed by their users, below).
+  it signs values with (Values signed by their users, below) and logs in with. A user
+  manages its own, whatever else it may do: `GET /auth/keys`, `PUT /auth/keys/<name>`
+  with the line, `DELETE /auth/keys/<name>`; under a strict policy, by signing its
+  entry with only its keys changed (`continuum-signed key-add laptop
+  ~/.ssh/id_ed25519.pub`, `key-remove laptop`), with a key it holds already. Every
+  node takes that from the user itself, as from one who may manage users.
 
 ## A new swarm