signatures: verified changes

GET /admin/changes shows whether a signature by its node vouches for
each change.

Auth plan M5.

1 files changed, 6 insertions, 2 deletions

diff --git a/docs/trust.md b/docs/trust.md
index 8b0f72a..70369e2 100644
--- a/docs/trust.md
+++ b/docs/trust.md
@@ -61,8 +61,12 @@ node acts on what the document says:
 
 * **User data**: any member can write or delete any path.
 * **Who wrote what** (`GET /admin/changes`): each change names its node and API user
-  as the writing node says; nothing signs that, so a member can name another. The
-  names of the users who write are in the document, and so on every node.
+  as the writing node says. Nodes sign their changes ([`api.md`](api.md), Signed
+  changes), so a change a signature vouches for shows `verified`: its node made it.
+  One that shows unverified may yet be vouched for by its node's next signature, or
+  may be another member's claiming that node; nothing is refused for it yet. The user a
+  change names is its node's claim, signed or not. The names of the users who write
+  are in the document, and so on every node.
 * **The member registry**: each node writes its own entry, but nothing stops a member
   from writing others'. The registry decides the topology and, through the alive
   stamps, the electorate of a remake.