fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.

README.md

@@ -144,6 +144,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `pki` | `s2s_name` | string | `VPN Router Site-to-Site CA` | Common name of the site-to-site issuing CA |
 | `pki` | `issuing_cas` | object | | The general-purpose issuing CAs, each a name and `{name, templates, acme}` (see Certificates) |
 | `pki` | `templates` | object | | Certificate templates, each a name and the options it changes or defines (see Certificates) |
+| `pki` | `root_key_warning` | boolean | `true` | `vpn-router-ca status` and `/ca` warn while the root key is on the router; `false` silences that warning |
 | `metrics` | `enabled` | boolean | `true` | The metrics service: collection, history and `/metrics` |
 | `metrics` | `listen` | string | `internal` | The interfaces `/metrics` is served on: `internal`, `external` or `both` |
 | `metrics` | `port` | integer | `9464` | TCP port of `/metrics` |
@@ -506,7 +507,8 @@ expired.
 
 ### Offline root
 
-Keeping the root key off the router is recommended, not required. Export it, encrypted with a
+Keeping the root key off the router is recommended, not required; while it is on the router,
+`vpn-router-ca status` says so, unless `pki.root_key_warning` is `false`. Export it, encrypted with a
 passphrase read from the first line of standard input, keep the file in a safe place, and remove
 the key from the router: