doc: Clarify

README.md

@@ -30,9 +30,9 @@ $ age -i my-keys --decrypt ./note-to-self
 remember to fix all bugs!
 ```
 
-By default the generated identity will require physical touch of TKey
-when it does ECDH key exchange. Use the flag `--no-touch` to generate
-an identity that does not.
+The generated identity will by default cause TKey to require physical
+touch before computing a shared key (doing ECDH). You can pass the
+flag `--no-touch` to generate an identity that does not.
 
 After running the above, te file `my-keys` ends up containing a line
 beginning with `AGE-PLUGIN-TKEY-`. This holds the parameters used for

cmd/age-plugin-tkey/main.go

@@ -38,7 +38,7 @@ func main() {
 	flag.StringVar(&agePluginFlag, "age-plugin", "", "For choosing state machine")
 	descGenerate := "Generate an identity backed by TKey"
 	descOutput := "Output identity to file at PATH"
-	descNoTouch := "Make the identity NOT require physical touch of TKey upon X25519 key exchange (use with --generate)"
+	descNoTouch := "Generate an identity for which the TKey will NOT require physical touch before computing a shared key (X25519 ECDH)"
 	descVersion := "Output version information and exit"
 	flag.BoolVar(&generateFlag, "generate", false, descGenerate)
 	flag.BoolVar(&generateFlag, "g", false, descGenerate)