add OpenBSD TA constraints and localhost TLS examples

docs/trust-anchors.md

@@ -6,7 +6,11 @@ Panda RPKI requires a TAL for each configured anchor. The TAL supplies the
 trusted public key and its certificate URI. You may pin a matching DER-encoded
 TA certificate in TOML, or omit `ta` and let Panda fetch, validate and cache the
 current certificate on each run. A certificate alone is not a substitute for an
-independently obtained TAL. No RIR inputs are bundled with this project.
+independently obtained TAL. The repository includes a pinned OpenBSD snapshot of all five TALs and resource
+constraints in [`tals/`](../tals/README.md); TA certificates are not bundled.
+The all5 Compose examples use these policies by default. Copy the ten files
+to your managed input directory, inspect their provenance, and follow the
+[Docker instructions](docker.md#all-five-rirs).
 
 ## Automatic and fixed certificate modes