signatures: --sign-every

Changes left unsigned are vouched for by the node's next signature:
--sign-every 1s (default) signs the latest within a second, all signs
every change, none only those that must be.

Auth plan M5.

2 files changed, 11 insertions, 1 deletions

diff --git a/docs/api.md b/docs/api.md
index e380c95..6a328a5 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -257,7 +257,10 @@ every change is signed, only those that
 * or were written with `?signed=true`.
 
 A change left unsigned, such as a metric written many times a second, is vouched for
-by the node's next signed one.
+by the node's next signed one: with `--sign-every 1s` (the default), the node signs its
+latest change at most a second after it if nothing signed it before, so every change is vouched
+for within a second, at one signature a second at most; `--sign-every all` signs every
+change as it is made, and `--sign-every none` signs only those above.
 
 ## Protocol data
 
diff --git a/docs/example.toml b/docs/example.toml
index 222db52..034976f 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -73,6 +73,13 @@ htpasswd = "/etc/continuum/htpasswd"
 # 0: never.
 # stream-heartbeat = "30s"
 
+# Which of its changes this node signs with its node key besides those touching
+# protocol data, paths listed in _continuum/access/signed, or written with
+# ?signed=true: "all", "none" (one left unsigned is vouched for by the node's next
+# signed change), or its latest change, if unsigned, this often (docs/api.md, Signed
+# changes).
+# sign-every = "1s"
+
 # How long a token this node issues (POST /auth/login, /auth/refresh) is taken, by every
 # node of the swarm (docs/access.md, Tokens). Refreshed before it ends, it lasts until
 # the login's end (session-lifetime).