Fix cross-vault OCSP snapshot poisoning

README.md

@@ -150,8 +150,8 @@ only as SHA-256 digests, and cannot mint/revoke tokens.
 KCA can publish full per-CA certificate-status snapshots to any S3-compatible
 bucket and ships a standalone Rust/Axum responder on port `2560`.
 
-- KCA publishes `ocsp/<CA certificate SHA-256>.json` whenever certificates are
-  issued, renewed, revoked, deleted or imported. Revocation reasons are
+- KCA publishes `ocsp/<KCA CA UUID>.json` whenever certificates are issued,
+  renewed, revoked, deleted or imported. Revocation reasons are
   included; this is a full status snapshot, not a revoked-only list.
 - The responder has no Postgres/Redis/KCA master-key access. It only reads the
   configured S3 prefix and uses a delegated OCSP signing certificate/key per
@@ -166,8 +166,8 @@ bucket and ships a standalone Rust/Axum responder on port `2560`.
 
 Enable publishing in KCA with `KCA_OCSP_S3_BUCKET` and the other
 `KCA_OCSP_*` variables in `server/.env.example`. Run the responder with a
-configuration derived from `ocsp-responder/responder.example.yaml`, or with
-Compose:
+configuration derived from `ocsp-responder/responder.example.yaml`, setting
+each issuer's `ca_id` to its CA certificate UUID in KCA, or with Compose:
 
 ```sh
 docker compose --profile ocsp up --build