Document basic cluster security - right now, just SSH CAs.