add security tip about key file