Authentication keys

Command	Purpose
vatio auth --new-key	Generate the keypair that signs your JWT, and print the auth: block and claims to use

It writes two files, and they go to different places. identity.pub stays in the workspace and is committed like any other file; identity.pem goes into your own backend as a secret, and should be deleted from the workspace directory once it is loaded there.

The command prints the auth: block to paste into vatio.yml and the claims to sign, so the output is most of the setup. Authentication has the rest, including why aud is required and what a private tool sees.