Say which commands need the private key, in README.md and config.example.yml

The last sentence of "The private key" and the matching comment in
config.example.yml named only the restore machine. snapshot verify --deep
needs the key too. Both now name both commands. The "Everyday use" block
gains a comment saying its next three commands run on a machine that holds
the private key.

Model: fable-5-1

config.example.yml

@@ -17,8 +17,8 @@ age_recipients:
 # Age private key for decryption
 # Only snapshot restore and snapshot verify --deep need it. The
 # VAULTIK_AGE_SECRET_KEY environment variable overrides this setting
-# Do not set it on a machine you back up: prefer the environment variable,
-# supplied only on the machine you restore on
+# Do not set it on a machine you back up. Supply the environment variable
+# only on a machine where you run snapshot restore or snapshot verify --deep
 # Default: not set
 #age_secret_key: YOUR_AGE_PRIVATE_KEY