add notice about root-owned secrets

rename public_keys to publicKeys

more idiomatic

exit of sub commands fail; don't re-encrypt if there is no diff; appl…

…y some shellcheck suggestions

fix spacing

fix README syntax