ADR-013 Phase 1: signed plugin artifacts (pack/validate/keygen)

.env.example

@@ -61,6 +61,12 @@ ZABBIX_TOKEN=
 # COLLECTOR_API_KEY=
 # COLLECTOR_API_KEY_COMPUTERS=
 
+# ---- Trusted plugin publisher keys (ADR-013, optional) ----
+# Public-key PEM paths (OS path separator: ':' on Linux, ';' on Windows) used
+# to verify signed plugin artifacts. Delivered with this config, NEVER from the
+# plugin shelf. Empty on a site that does not adopt marketplace plugins.
+# PLUGIN_TRUSTED_KEYS=/etc/shopdb/keys/curator.pub
+
 # ---- Employee directory database (optional, read-only) ----
 # Separate HR/employee lookup DB consumed by the notifications plugin and the
 # public shopfloor kiosks. Leave unset if the feature is not used; there is no