Say which commands need the private key, in README.md and config.example.yml

The last sentence of "The private key" and the matching comment in
config.example.yml named only the restore machine. snapshot verify --deep
needs the key too. Both now name both commands. The "Everyday use" block
gains a comment saying its next three commands run on a machine that holds
the private key.

Model: fable-5-1

README.md

@@ -104,6 +104,7 @@ it the backup stops with a permission error on a protected directory.
 # Check that a snapshot's blobs are all present, with the listed sizes.
 vaultik snapshot verify <snapshot-id>
 
+# Run the next three commands on a machine that holds the private key.
 # Put the private key in the environment. Reading it from the file keeps it
 # out of your shell history.
 export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
@@ -881,8 +882,8 @@ export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
 ```
 
 Do not put the private key on a machine you back up. Anyone who breaks into that
-machine could then decrypt its backups. Supply the key only on the machine you
+machine could then decrypt its backups. Supply the key only on the machine where
-restore on.
+you run `snapshot restore` or `snapshot verify --deep`.
 
 ### Exclude patterns
 

config.example.yml

@@ -17,8 +17,8 @@ age_recipients:
 # Age private key for decryption
 # Only snapshot restore and snapshot verify --deep need it. The
 # VAULTIK_AGE_SECRET_KEY environment variable overrides this setting
-# Do not set it on a machine you back up: prefer the environment variable,
+# Do not set it on a machine you back up. Supply the environment variable
-# supplied only on the machine you restore on
+# only on a machine where you run snapshot restore or snapshot verify --deep
 # Default: not set
 #age_secret_key: YOUR_AGE_PRIVATE_KEY