Add a doc about bootstrapping.

After working through this for the third or fourth time, I thought it was time to write it down.
The system identity is now generated in the bootstrap agent.