2 files changed, 9 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index a182266..d81f115 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -38,7 +38,10 @@ password hashes: every member reads the document).
 A swarm gets a registry from its start if its genesis node is given its first users,
 `--bootstrap-users`: it records them, with the swarm ID, in its first change, each with
 everything (`[]` and `["_continuum"]`). Other users, of its `--htpasswd` or any node's,
-may do nothing until added (the genesis node warns of those of its `--htpasswd`).
+may do nothing until added (the genesis node warns of those of its `--htpasswd`). With
+`--bootstrap-keys alice=ssh-ed25519\ AAAA…\ laptop` it records their keys too, so they
+log in by key and sign values from the start: a swarm whose first user then writes the
+policy (Values signed by their users, below) is strict from its start.
 Without it, the swarm has no registry: its users are all alike (A swarm without a
 registry, below), until someone gives it one. `--protocol-writers` counts in
 both: without a registry, as who may write protocol data; with one, to set it right
diff --git a/docs/example.toml b/docs/example.toml
index 034976f..d2d9a67 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -115,6 +115,11 @@ htpasswd = "/etc/continuum/htpasswd"
 # and only those in protocol-writers write protocol data.
 # bootstrap-users = ["alice"]
 
+# With bootstrap-users: their SSH keys, as authorized_keys lines (ssh-ed25519 <base64>
+# [comment], named by the comment), recorded in their entries: to log in by key and sign
+# values (docs/access.md), so a swarm can be strict from its start.
+# bootstrap-keys = ["alice=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA… laptop"]
+
 # How log lines look: text (timestamped), journal (for systemd's journal: no timestamp or
 # colours, the level as each line's priority, for journalctl -p), or auto: journal when
 # stdout goes to the journal, else text.