Say which commands need the private key, in README.md and config.example.yml

The last sentence of "The private key" and the matching comment in
config.example.yml named only the restore machine. snapshot verify --deep
needs the key too. Both now name both commands. The "Everyday use" block
gains a comment saying its next three commands run on a machine that holds
the private key.

Model: fable-5-1

README.md

@@ -104,6 +104,7 @@ it the backup stops with a permission error on a protected directory.
 # Check that a snapshot's blobs are all present, with the listed sizes.
 vaultik snapshot verify <snapshot-id>
 
+# Run the next three commands on a machine that holds the private key.
 # Put the private key in the environment. Reading it from the file keeps it
 # out of your shell history.
 export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
@@ -881,8 +882,8 @@ export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
 ```
 
 Do not put the private key on a machine you back up. Anyone who breaks into that
-machine could then decrypt its backups. Supply the key only on the machine you
-restore on.
+machine could then decrypt its backups. Supply the key only on the machine where
+you run `snapshot restore` or `snapshot verify --deep`.
 
 ### Exclude patterns