chore: simplify plugin readmes, changelogs and manifest descriptions

plugins/termix-identity/README.md

@@ -1,33 +1,37 @@
 # Termix Identity
 
-Claim a public handle and publish your SSH public keys under it. Any server
-can then pull them into `authorized_keys`:
+Publish your SSH public keys under a public handle and run your own SSH certificate authority.
+
+## Features
+
+- Claim a public handle and publish your SSH public keys under it.
+- Run your own SSH certificate authority for each handle.
+- Issue short-lived certificates for your Ed25519 keys.
+
+## Setup
+
+Any server can pull your keys into `authorized_keys`:
 
 ```bash
 curl -fsSL https://<termix>/plugin-api/termix-identity/u/<handle> >> ~/.ssh/authorized_keys
 ```
 
-Add `/<ALGO>` (for example `/ED25519`) to serve only one key type. The
-resolver needs no login and is never cached.
+Add `/<ALGO>`, for example `/ED25519`, to get only one key type. This URL needs no login and is never cached.
 
-## Certificate authority
+To use the certificate authority, point `TrustedUserCAKeys` on your servers at the public key from `/u/<handle>/ca`. Rotating the CA revokes every certificate it issued. Certificates are downloaded once and not stored, so Termix hosts do not use them to connect.
 
-Each handle can have its own SSH certificate authority. Servers trust it with
-`TrustedUserCAKeys`, using the public key from `/u/<handle>/ca`. Termix then
-issues short-lived certificates for your Ed25519 keys. Rotating the CA
-revokes every certificate it issued. The CA private key is stored encrypted
-with the installation key.
+The 2.8 URLs under `/termix-id/u/` redirect here, so existing scripts keep working. Use `curl -L` to follow the redirect.
 
-Certificates are downloaded once and never stored, so hosts in Termix do not
-use them to connect. This plugin adds no SSH auth type.
+## Permissions
 
-## Old URLs
+- `termix-identity.use`: Claim a handle, publish keys and run a CA. Admins and users have it by default.
 
-The 2.8 resolver URLs (`/termix-id/u/<handle>`, `/termix-id/u/<handle>/<ALGO>`
-and `/termix-id/u/<handle>/ca`) permanently redirect here, so servers that
-fetch them from scripts keep working. `curl -L` follows the redirect.
+## Development
 
-## Permission
+```bash
+npm run build      # build into dist/
+npm run test       # run this plugin's tests
+npm run typecheck  # type-check this plugin
+```
 
-`termix-identity.use` lets a user claim a handle, publish keys and run a CA.
-Admins and users have it by default.
+See `packages/plugin-sdk/ARCHITECTURE.md` for the plugin contract.