Merge remote-tracking branch 'origin/mdw/master.found-crybaby'

* origin/mdw/master.found-crybaby:
  server/bulkcrypto.c: Document the procedures for producing challenges.
  server/chal.c: Add a missing blank line.
  server/tripe-admin.5.in: Place the blame correctly for a couple of errors.
  svc/connect.8.in: Fix message formatting.
  server/tripe-admin.5.in: Remove incorrect blame on Catacomb.
  server/tripe-admin.5.in: Improve some clumsy wording.
  server/tripe-admin.5.in: Add cross-reference for ECODE and MESSAGE.
  server/tripe-admin.5.in: Add missing origin-command notes to errors.
  server/tripe-admin.5.in: Use gender-neutral pronouns.
  server/bulkcrypto.c: Fix description comment for AEAD schemes.
  py/tripe.py.in: Raise an error if a command token contains a newline.

diff --combined server/tripe-admin.5.in
index ba29f12,e212b75..e637650
--- 1/server/tripe-admin.5.in
--- 2/server/tripe-admin.5.in
+++ b/server/tripe-admin.5.in
@@@ -614,13 -614,9 +614,13 @@@ line giving the tag for each outstandin
  .BI "KILL " peer
  Causes the server to forget all about
  .IR peer .
 -All keys are destroyed, and no more packets are sent.  No notification
 -is sent to the peer: if it's important that the peer be notified, you
 -must think of a way to do that yourself.
 +All keys are destroyed, and no more packets are sent.  A
 +.B bye
 +message is sent to the peer if it's marked as
 +.B "\-ephemeral"
 +\(en see the
 +.B "ADD"
 +command.
  .SP
  .B "LIST"
  For each currently-known peer, an
@@@ -1064,7 -1060,9 +1064,9 @@@ string was invalid
  of arguments was wrong.
  .SP
  .BI "bad-time-spec " token
- The
+ (For commands accepting a
+ .I time
+ argument.)  The
  .I token
  is not a valid time interval specification.  Acceptable time
  specifications are nonnegative integers followed optionally by
@@@ -1090,6 -1088,12 +1092,12 @@@ An unknown watch option was requested
  .BR DAEMON .)
  An error occurred during the attempt to become a daemon, as reported by
  .IR message .
+ See
+ .B WARNINGS
+ below for the meanings of
+ .I ecode
+ and
+ .IR message .
  .SP
  .BI "disabled-address-family " afam
  (For
@@@ -1133,6 -1137,8 +1141,8 @@@ There is already a peer name
  .IR peer .
  .SP
  .B "ping-send-failed"
+ (For
+ .BR EPING .)
  The attempt to send a ping packet failed, probably due to lack of
  encryption keys.
  .SP
@@@ -1443,7 -1449,7 +1453,7 @@@ command or in greeting packets
  .SP
  .B "CHAL impossible-challenge"
  The server hasn't issued any challenges yet.  Quite how anyone else
- thought he could make one up is hard to imagine.
+ thought they could make one up is hard to imagine.
  .SP
  .B "CHAL incorrect-tag"
  Challenge received contained the wrong authentication data.  It might be
@@@ -1506,8 -1512,9 +1516,9 @@@ implementation of HMAC for the selecte
  .BI "KEYMGMT " which "-keyring " file " key " tag " unknown-bulk-transform " bulk
  The key specifies the use of an unknown bulk-crypto transform
  .IR bulk .
- Maybe the key was generated wrongly, or maybe the version of Catacomb
- installed is too old.
+ Maybe the key was generated wrongly, or maybe the version of
+ .BR tripe (8)
+ is too old.
  .SP
  .BI "KEYMGMT " which "-keyring " file " key " tag " unknown-cipher " cipher
  The key specifies the use of an unknown symmetric encryption algorithm
@@@ -1544,7 -1551,9 +1555,9 @@@ version of Catacomb installed is too ol
  The key specifies the use of an unknown serialization format
  .I ser
  for hashing group elements.  Maybe the key was generated wrongly, or
- maybe the version of Catacomb installed is too old.
+ maybe the version of
+ .BR tripe (8)
+ is too old.
  .SP
  .BI "KEYMGMT " which "-keyring " file " key " tag " unsuitable-aead-cipher " cipher "no-aad"
  The key specifies the use of an authenticated encryption scheme
@@@ -1566,10 -1575,9 +1579,9 @@@ use th
  .B naclbox
  bulk transform rather than
  .B aead
- for these
- (or switch to the IETF
+ for these, or switch to one of the IETF
  .IB cipher -poly1305
- schemes instead).
+ schemes instead.
  .SP
  .BI "KEYMGMT " which "-keyring " file " key " tag " unsuitable-aead-cipher " cipher "nonce-too-small"
  The key specifies the use of an authenticated encryption scheme