document key files in a new Internals page

this is still incomplete as it only describes key files, but doesn't
clearly say how chunks are encrypted or decrypted.

this address parts of #29 but eventually that document should also
cover #27, #28 and maybe #45