From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date: Sat, 17 Feb 2018 15:52:20 -0500
Subject: Update documentation of --keyfile-ro

On Debian systems, we depend on the OS package management to update
the dns root data.  Make the documentation for running with this
option less scary-sounding, as it is the default.
---
 doc/kresd.8.in | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/doc/kresd.8.in b/doc/kresd.8.in
index b93a0f4..05a9dd6 100644
--- a/doc/kresd.8.in
+++ b/doc/kresd.8.in
@@ -24,7 +24,7 @@
 .IR config ]
 .RB [ \-k | \-\-keyfile
 .IR keyfile ]
-.RB [ \-K | \-\-keyfile-ro
+.RB [ \-K | \-\-keyfile\-ro
 .IR keyfile ]
 .RB [ \-m | \-\-moduledir
 .IR path ]
@@ -123,7 +123,7 @@ file at the default location (\fIconfig\fR). The syntax is
 described in \fIdaemon/README.md\fR.
 .TP
 .B \-k\fI keyfile\fR, \fB\-\-keyfile=\fI<keyfile>
-(Recommended!) Automatically managed root trust anchors file.
+Automatically managed root trust anchors file.
 Root trust anchors in this file are managed using standard RFC 5011 (Automated Updates of DNS Security Trust Anchors).
 Kresd needs write access to the directory containing the keyfile.
 
@@ -133,10 +133,13 @@ and warning that you need to to check the key before trusting it will be issued.
 The file contains DNSKEY/DS records in presentation format,
 and is compatible with Unbound and BIND 9 root key files.
 .TP
-.B \-K\fI keyfile\fR, \fB\-\-keyfile-ro=\fI<keyfile>
-(Discouraged) Static root trust anchors file. The file is not updated by kresd. Use of this option is discouraged because it will break your installation when the trust anchor key changes!
+.B \-K\fI keyfile\fR, \fB\-\-keyfile\-ro=\fI<keyfile>
+Static root trust anchors file. The file is not updated by
+kresd. Please ensure that any running kresd instances are restarted if
+the trust anchors change. (On Debian, this should happen automatically
+on upgrade of the dns-root-data package).
 
-Default: "@KEYFILE_DEFAULT@" (can be empty if your distribution did not provide one)
+Default: "@KEYFILE_DEFAULT@"
 .TP
 .B \-m\fI path\fR, \fB\-\-moduledir=\fI<path>
 Override the directory that is searched for modules.  Default: @MODULEDIR@
