shell: Assorted --help fixes.

shell/caucase.sh

@@ -538,6 +538,9 @@ General options
 --key-len BITS
   Default: 2048
   Size of the private key to generate. See --renew-crt .
+--user-key PATH
+  A file containing a private key and corresponding certificate, to
+  authenticate as a caucase user.
 --mode {service|user}
   Default: service
   Caucase personality to query.
@@ -569,7 +572,7 @@ Anonymous actions
   also update the equivalents for user mode. You should not need this.
 
 Authenticated actions
-These options require --user-crt .
+These options require --user-key .
 --list-csr
   List pending certificate signing requests.
 --sign-csr CSR_ID
@@ -577,7 +580,7 @@ These options require --user-crt .
 --sign-csr-with CSR_ID CSR_PATH
   Sign the pending request with identifier CSR_ID, replacing its extensions with
   the ones from CSR_PATH.
---reject_csr
+--reject-csr
   Reject pending request with identifier CSR_ID.
 --revoke-other-crt CRT_PATH
   Revoke certificate read from CRT_PATH, without requiring access to its private