wip snapshot after account logout; squash into the unit commit

Model: fable-5-1

README.md

@@ -257,8 +257,9 @@ are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
 
 - Should the manifest signature format be GnuPG signatures, or those from
   OpenBSD's signify (of which there is a good
-  [golang implementation](https://github.com/frankbraun/gosignify))? Still open,
-  as question 10 on [issue 82](https://git.eeqj.de/sneak/mfer/issues/82).
+  [golang implementation](https://github.com/frankbraun/gosignify))? Settled:
+  OpenPGP signatures, made and checked by mfer in Go without running `gpg`, as
+  question 10 on [issue 82](https://git.eeqj.de/sneak/mfer/issues/82).
 
 - Should the on-disk serialization format be proto3 or json? Settled: it is
   proto3, see `docs/FORMAT.md` and `mfer/mf.proto`.
@@ -287,6 +288,14 @@ are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
     - leaves out hidden files unless given `--include-dotfiles`, and symlinks
       unless given `--follow-symlinks`, which lists each symlink to a file under
       its own name with the contents of the file it points to
+- `mfer gen --sign-key key.asc` / `mfer freshen --sign-key key.asc`
+    - signs the manifest with the OpenPGP secret key in `key.asc`, armored or
+      binary, as `gpg --export-secret-keys` writes it; `MFER_SIGN_KEY` names the
+      file too. mfer signs it itself and does not need `gpg`. A file holding
+      more than one key is refused, and a key held only on a smartcard cannot
+      sign
+    - takes a protected key's passphrase from `MFER_SIGN_KEY_PASSPHRASE`, or
+      else asks for it at the terminal
 - `mfer fetch https://example.com/stuff/`
     - fetches `/stuff/index.mf` and downloads all files listed in manifest into
       the current directory, or the one given with `--dest`, and assures