docs: reading keys and declarations

Clients checking signatures or sealing read the registry and
_continuum/access: operators grant reading them.

Auth plan M7, M8 (docs).

1 files changed, 2 insertions, 0 deletions

diff --git a/scripts/continuum-signed b/scripts/continuum-signed
index 4ce68db..dc5bd75 100755
--- a/scripts/continuum-signed
+++ b/scripts/continuum-signed
@@ -28,6 +28,8 @@
 #
 # `seal` seals for every key of each reader, as the registry has them; `open` opens with
 # CONTINUUM_KEY, which must then be the private key itself (age reads no agent).
+# `verify` and `seal` read the registry (`_continuum/users`) and the declarations
+# (`_continuum/access`): the user needs reading them (docs/access.md).
 # `verify` checks one level: the envelope against the user's keys as the node shows
 # the registry. The registry's entries are values signed by their users too; checking
 # them, and theirs, up to users one trusts, is `verify` again, on each.