describe key rotation

[job]

• initial seed is obtained out-of-band: either by trusting a public key received via email, or fetched from well-known URI
• key rotation happens in-band via the notification file
• to facilitate key rollover the notification file will be signed by new key, and list what the old key was, so the client knows which key to delete

[mxsasha]

This was addressed and merged already :)