signatures: sign what is sent

A node signed its changes no rule signs a while after them (--sign-every
1s): the change left at once, unsigned, and its signature followed on
its own a second later, to every neighbour, over every link. A few
writes made a cascade of SIGNATURES. Under a policy requiring
signatures it signed every change as it was made instead.

A node now signs its latest change, if no signature vouches for it, as
a sync message takes it (--sign-every sent, the default): the
signature leaves in the same message, and goes where the change goes.
One signature per message, however many changes it carries, each
vouching for those before it: a slow writer's every change is signed,
a fast writer's batches are, at no threshold to pick. A policy
requiring signatures signs what is sent too, even with `none`. `all`
still signs every change as it is made; changes to protocol data,
listed paths and ?signed=true writes are signed as they are made, as
before. The interval, and the task signing on it, go.

1 files changed, 3 insertions, 3 deletions

diff --git a/src/config/mod.rs b/src/config/mod.rs
index 4230b65..7df68e7 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -126,9 +126,9 @@ pub(crate) const OPTIONS: &[OptionSpec] = &[
     option(
         "sign-every",
         Kind::Text,
-        "all|none|DURATION",
-        Some("1s"),
-        "Which of its changes this node signs with its node key besides those touching protocol data, paths listed in _continuum/access/signed, or written with ?signed=true: all of them; none (one left unsigned is vouched for by the node's next signed change); or its latest change, if unsigned, this often, so every change is vouched for within it (docs/api.md, Signed changes).",
+        "all|sent|none",
+        Some("sent"),
+        "Which of its changes this node signs with its node key besides those touching protocol data, paths listed in _continuum/access/signed, or written with ?signed=true: its latest, as a sync message takes it (sent: one signature per message, vouching for the changes before it); every change as it is made (all); or none (one left unsigned is vouched for by the node's next signed change; as sent under a policy requiring signatures). docs/api.md, Signed changes, says which to choose.",
     ),
     option(
         "token-lifetime",