Improve documentation around generating root keys

[lmars]

The "create signed root manifest" example (which is the first thing repository maintainers need to do) needs to be clearer on why files need copying from a "root" box to a "repo" box, and that using multiple machines is optional (at the expense of reduced security).

[mnm678]

cc @asraa This might relate to the cosign key generation

[rdimitrov]

Closing since the code base changed and the goal of the project would be to focus on being a library first and not so much on providing a CLI client.

There might be a CLI based on this, but it will live in a separate repository.

Thanks for raising this! 👍