added directions for using `secure-root.yml`