- Correct WELIST_ALLOW_LEGACY_PING: legacy pings are accepted by default,
the flag only disables them.
- Describe onion delegation: v2-only inclusion, service-side host
normalization, strict expiry check, deployment order and rollback.
- Warn that disabled delegation rejects onion pings when SSL_KEY_PATH is
the dedicated ping key.
- Document certificate lifetime and revocation limits, offline master
key requirements, helper --days bounds, and a delegation verification
checklist.
- Fix the bal-pusher.sh comment about the service-side defaults.
svatantrya
78e4f72255
