=== modified file 'TODO'
--- TODO	2008-08-31 07:32:05 +0000
+++ TODO	2008-08-31 08:47:38 +0000
@@ -104,7 +104,7 @@
 *** OPTIONS
     Separate <term> tags with <option> and <replaceable> tags.
 **** DONE mandos-clients.conf.xml
-**** TODO mandos-keygen.xml
+**** DONE mandos-keygen.xml
 **** DONE mandos.conf.xml
 **** TODO mandos.xml
 **** TODO plugin-runner.xml

=== modified file 'mandos-keygen'
--- mandos-keygen	2008-08-25 03:53:42 +0000
+++ mandos-keygen	2008-08-31 08:47:38 +0000
@@ -64,7 +64,7 @@
   -n NAME, --name NAME  Name of key.  Default is the FQDN.
   -e ADDRESS, --email ADDRESS
                         Email address of key.  Default is empty.
-  -c COMMENT, --comment COMMENT
+  -c TEXT, --comment TEXT
                         Comment field for key.  The default value is
                         "Mandos client key".
   -x TIME, --expire TIME
@@ -75,7 +75,7 @@
 Password creation options:
   -p, --password        Create an encrypted password using the keys in
                         the key directory.  All options other than
-                        --keydir and --name are ignored.
+                        --dir and --name are ignored.
 EOF
 }
 

=== modified file 'mandos-keygen.xml'
--- mandos-keygen.xml	2008-08-31 07:32:05 +0000
+++ mandos-keygen.xml	2008-08-31 08:47:38 +0000
@@ -67,8 +67,7 @@
   <refnamediv>
     <refname><command>&COMMANDNAME;</command></refname>
     <refpurpose>
-      Generate keys for <citerefentry><refentrytitle>password-request
-      </refentrytitle><manvolnum>8mandos</manvolnum></citerefentry>
+      Generate key and password for Mandos client and server.
     </refpurpose>
   </refnamediv>
 
@@ -176,44 +175,44 @@
       </group>
     </cmdsynopsis>
   </refsynopsisdiv>
-
+  
   <refsect1 id="description">
     <title>DESCRIPTION</title>
     <para>
       <command>&COMMANDNAME;</command> is a program to generate the
-      OpenPGP keys used by
+      OpenPGP key used by
       <citerefentry><refentrytitle>password-request</refentrytitle>
-      <manvolnum>8mandos</manvolnum></citerefentry>.  The keys are
+      <manvolnum>8mandos</manvolnum></citerefentry>.  The key is
       normally written to /etc/mandos for later installation into the
-      initrd image, but this, like most things, can be changed with
-      command line options.
+      initrd image, but this, and most other things, can be changed
+      with command line options.
     </para>
     <para>
-      It can also be used to generate ready-made sections for
+      This program can also be used with the
+      <option>--password</option> option to generate a ready-made
+      section for <filename>clients.conf</filename> (see
       <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
-      <manvolnum>5</manvolnum></citerefentry> using the
-      <option>--password</option> option.
+      <manvolnum>5</manvolnum></citerefentry>).
     </para>
   </refsect1>
   
   <refsect1 id="purpose">
     <title>PURPOSE</title>
-
     <para>
       The purpose of this is to enable <emphasis>remote and unattended
       rebooting</emphasis> of client host computer with an
       <emphasis>encrypted root file system</emphasis>.  See <xref
       linkend="overview"/> for details.
     </para>
-
   </refsect1>
   
   <refsect1 id="options">
     <title>OPTIONS</title>
-
+    
     <variablelist>
       <varlistentry>
-	<term><literal>-h</literal>, <literal>--help</literal></term>
+	<term><option>--help</option></term>
+	<term><option>-h</option></term>
 	<listitem>
 	  <para>
 	    Show a help message and exit
@@ -222,8 +221,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-d</literal>, <literal>--dir
-	<replaceable>directory</replaceable></literal></term>
+	<term><option>--dir
+	<replaceable>DIRECTORY</replaceable></option></term>
+	<term><option>-d
+	<replaceable>DIRECTORY</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Target directory for key files.  Default is
@@ -233,8 +234,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-t</literal>, <literal>--type
-	<replaceable>type</replaceable></literal></term>
+	<term><option>--type
+	<replaceable>TYPE</replaceable></option></term>
+	<term><option>-t
+	<replaceable>TYPE</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Key type.  Default is <quote>DSA</quote>.
@@ -243,8 +246,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-l</literal>, <literal>--length
-	<replaceable>bits</replaceable></literal></term>
+	<term><option>--length
+	<replaceable>BITS</replaceable></option></term>
+	<term><option>-l
+	<replaceable>BITS</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Key length in bits.  Default is 2048.
@@ -253,8 +258,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-s</literal>, <literal>--subtype
-	<replaceable>type</replaceable></literal></term>
+	<term><option>--subtype
+	<replaceable>KEYTYPE</replaceable></option></term>
+	<term><option>-s
+	<replaceable>KEYTYPE</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Subkey type.  Default is <quote>ELG-E</quote> (Elgamal
@@ -264,8 +271,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-L</literal>, <literal>--sublength
-	<replaceable>bits</replaceable></literal></term>
+	<term><option>--sublength
+	<replaceable>BITS</replaceable></option></term>
+	<term><option>-L
+	<replaceable>BITS</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Subkey length in bits.  Default is 2048.
@@ -274,8 +283,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-e</literal>, <literal>--email</literal>
-	<replaceable>address</replaceable></term>
+	<term><option>--email
+	<replaceable>ADDRESS</replaceable></option></term>
+	<term><option>-e
+	<replaceable>ADDRESS</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Email address of key.  Default is empty.
@@ -284,8 +295,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-c</literal>, <literal>--comment</literal>
-	<replaceable>comment</replaceable></term>
+	<term><option>--comment
+	<replaceable>TEXT</replaceable></option></term>
+	<term><option>-c
+	<replaceable>TEXT</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Comment field for key.  The default value is
@@ -295,8 +308,10 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-x</literal>, <literal>--expire</literal>
-	<replaceable>time</replaceable></term>
+	<term><option>--expire
+	<replaceable>TIME</replaceable></option></term>
+	<term><option>-x
+	<replaceable>TIME</replaceable></option></term>
 	<listitem>
 	  <para>
 	    Key expire time.  Default is no expiration.  See
@@ -307,16 +322,17 @@
       </varlistentry>
 
       <varlistentry>
-	<term><literal>-f</literal>, <literal>--force</literal></term>
+	<term><option>--force</option></term>
+	<term><option>-f</option></term>
 	<listitem>
 	  <para>
-	    Force overwriting old keys.
+	    Force overwriting old key.
 	  </para>
 	</listitem>
       </varlistentry>
       <varlistentry>
-	<term><literal>-p</literal>, <literal>--password</literal
-	></term>
+	<term><option>--password</option></term>
+	<term><option>-p</option></term>
 	<listitem>
 	  <para>
 	    Prompt for a password and encrypt it with the key already
@@ -328,7 +344,7 @@
 	    >8</manvolnum></citerefentry>.  The host name or the name
 	    specified with the <option>--name</option> option is used
 	    for the section header.  All other options are ignored,
-	    and no keys are created.
+	    and no key is created.
 	  </para>
 	</listitem>
       </varlistentry>
@@ -340,15 +356,17 @@
     <xi:include href="overview.xml"/>
     <para>
       This program is a small utility to generate new OpenPGP keys for
-      new Mandos clients.
+      new Mandos clients, and to generate sections for inclusion in
+      <filename>clients.conf</filename> on the server.
     </para>
   </refsect1>
 
   <refsect1 id="exit_status">
     <title>EXIT STATUS</title>
     <para>
-      The exit status will be 0 if new keys were successfully created,
-      otherwise not.
+      The exit status will be 0 if a new key (or password, if the
+      <option>--password</option> option was used) was successfully
+      created, otherwise not.
     </para>
   </refsect1>
   
@@ -425,7 +443,7 @@
     </informalexample>
     <informalexample>
       <para>
-	Create keys in another directory and of another type.  Force
+	Create key in another directory and of another type.  Force
 	overwriting old key files:
       </para>
       <para>
@@ -435,6 +453,29 @@
 
       </para>
     </informalexample>
+    <informalexample>
+      <para>
+	Prompt for a password, encrypt it with the key in
+	<filename>/etc/mandos</filename> and output a section suitable
+	for <filename>clients.conf</filename>.
+      </para>
+      <para>
+	<userinput>&COMMANDNAME; --password</userinput>
+      </para>
+    </informalexample>
+    <informalexample>
+      <para>
+	Prompt for a password, encrypt it with the key in the
+	<filename>client-key</filename> directory and output a section
+	suitable for <filename>clients.conf</filename>.
+      </para>
+      <para>
+
+<!-- do not wrap this line -->
+<userinput>&COMMANDNAME; --password --dir client-key</userinput>
+
+      </para>
+    </informalexample>
   </refsect1>
 
   <refsect1 id="security">
@@ -442,12 +483,12 @@
     <para>
       The <option>--type</option>, <option>--length</option>,
       <option>--subtype</option>, and <option>--sublength</option>
-      options can be used to create keys of insufficient security.  If
-      in doubt, leave them to the default values.
+      options can be used to create keys of low security.  If in
+      doubt, leave them to the default values.
     </para>
     <para>
-      The key expire time is not guaranteed to be honored by
-      <citerefentry><refentrytitle>mandos</refentrytitle>
+      The key expire time is <emphasis>not</emphasis> guaranteed to be
+      honored by <citerefentry><refentrytitle>mandos</refentrytitle>
       <manvolnum>8</manvolnum></citerefentry>.
     </para>
   </refsect1>
@@ -457,6 +498,8 @@
     <para>
       <citerefentry><refentrytitle>gpg</refentrytitle>
       <manvolnum>1</manvolnum></citerefentry>,
+      <citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
+      <manvolnum>5</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>mandos</refentrytitle>
       <manvolnum>8</manvolnum></citerefentry>,
       <citerefentry><refentrytitle>password-request</refentrytitle>

=== modified file 'overview.xml'
--- overview.xml	2008-08-23 07:17:28 +0000
+++ overview.xml	2008-08-31 08:47:38 +0000
@@ -3,13 +3,13 @@
 	"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
 <para>
   This is part of the Mandos system for allowing computers to have
-  encrypted root file systems and also be capable of remote and
-  unattended reboots.  The computers run a small client program in the
-  initial RAM disk environment which will communicate with a server
-  over a network.  The clients are identified by the server using a
-  OpenPGP key; each client has one unique to it.  The server sends the
-  clients an encrypted password.  The encrypted password is decrypted
-  by the clients using the same OpenPGP key, and the password is then
-  used to unlock the root file system, whereupon the computers can
-  continue booting normally.
+  encrypted root file systems and at the same time be capable of
+  remote and/or unattended reboots.  The computers run a small client
+  program in the initial RAM disk environment which will communicate
+  with a server over a network.  The clients are identified by the
+  server using a OpenPGP key; each client has one unique to it.  The
+  server sends the clients an encrypted password.  The encrypted
+  password is decrypted by the clients using the same OpenPGP key, and
+  the password is then used to unlock the root file system, whereupon
+  the computers can continue booting normally.
 </para>