Clean up usage

[hallyn]

strawman:

trust keyset [ list | new ] : list top-level keysets, or create a new one.  E.g. homenet.
trust project [ list | new keyset project-name ] : create a new project uuid, under some keyset (e.g. homenet), and give it a name (e.g. laptops); also create a bootable provisioning iso.
trust sudi [ list [keyset [project] ] | create keyset project serial-number ]

'machine init [ serial-number ] - if given a serial number, will use the sudi key for given serial number to provision the new VM before calling it done.  Otherwise, either skip provisioning or else (a) create a random SN, (b) call trust gen-sudi, and (c) use the resulting SUDI keys to provision

[hallyn]

When I say --keyset should be a global option, it should also be the option for mosctl ,mosb, etc, which currently take --key and --cert.

[raharper]

strawman:

trust keyset [ list | new ] : list top-level keysets, or create a new one.  E.g. homenet.
trust project [ list | new keyset project-name ] : create a new project uuid, under some keyset (e.g. homenet), and give it a name (e.g. laptops); also create a bootable provisioning iso.
trust sudi [ list [keyset [project] ] | create keyset project serial-number ]

The sequence would look like this?

trust keyset new homenet
trust project new laptops --keyset homenet
trust sudi laptops --project laptops

If I have that right, what about:

trust create keyset homenet
trust create project laptops --keyset homenet
trust create serial-number --project laptops   # keyset is implied by project

Or

trust keyset add homenet
trust project add laptops --keyset homenet
trust serial-number add --project laptops

It's not clear if I would run trust sudi more than once, I think one can
so the add verb makes more sense to me.

And I wonder if sudi or serial-number should take attributes of the machine
it will be bound to?

trust sudi pid XXX-YYY sn ABC1234 --project laptops

Wouldn't some part of the system we're binding the trust to need to be
present in the generated SUDI?

[hallyn]

'add' is fine, although it may be confusing as that might also mean add an existing one, versus creating a new one.

I prefer to keep keyset|project|sudi as the main verb and list|add as the sub-command.

I don't see the point in "--keyset" being added optionally at the end, as opposed to be mandatory (before the name of the new project), unless I we have a default. Do we want a default? Do we want it to be "default"?

The serial number is the main thing I know of to put into the sudi.cert to "bind" it to a device. If there are other things that are useful then we should definitely optionally accept them.