Clarifications on sops

sso-mfa/bootstrap/README.md

@@ -115,3 +115,24 @@ See `../vault/` (created in T01 Phase 0b) for:
 - ESO (External Secrets Operator) configuration
 - Vault secret path layout
 - Migration procedure: KeePassXC → Vault
+
+## Custody Age Key Unlock
+
+For SOPS-backed drills and incident work, do not copy the custodian age private
+key into a permanent workstation path. Use the custody helper from the repo root:
+
+```bash
+make sops-custody-run COMMAND='make -C /home/worsch/inter-hub recovery-drill'
+```
+
+The helper prompts for the `AGE-SECRET-KEY-1...` line from the password safe or
+offline custody packet, validates it against `keys/age.pub`, writes a temporary
+`SOPS_AGE_KEY_FILE`, runs the command, and removes the temporary file on exit.
+
+For multi-step recovery work:
+
+```bash
+make sops-custody-shell
+```
+
+Exit the shell when finished so the temporary key file is removed.