add OpenBSD TA constraints and localhost TLS examples

tals/README.md

@@ -0,0 +1,42 @@
+# RIR trust anchors and resource constraints
+
+These five TALs and five matching constraints files are unmodified copies from
+[OpenBSD src/etc/rpki](https://github.com/openbsd/src/tree/c10aa57bf0a6504676d00e24f531b5a0f3fa19de/etc/rpki).
+
+- Upstream repository: https://github.com/openbsd/src
+- Pinned commit: `c10aa57bf0a6504676d00e24f531b5a0f3fa19de`
+- Retrieved: 2026-09-18 (UTC)
+- Integrity: `cd tals && sha256sum --check SHA256SUMS`
+
+Upstream comments, attribution and terms are retained in each original file.
+In particular, read the ARIN disclaimer in `arin.tal`
+before using it. These third-party data files are not relicensed under the
+Panda RPKI source-code license. See OpenBSD's [copyright policy](https://www.openbsd.org/policy.html)
+for its distribution policy; the per-file notices and referenced terms remain applicable.
+
+The files contain trust-anchor locators and local resource policy, not TA
+certificates. Automatic TA certificate refresh does not update these files.
+Constraints limit resources accepted for signed objects beneath the matching
+anchor; review upstream changes before adopting them.
+
+## Use and customization
+
+Copy the ten files into a directory you manage and set Compose `INPUT_DIR` to
+that directory. Both all5 TOML examples explicitly enable constraints and use
+`/input/<rir>.constraints`. Edit those files or set an anchor's `constraints`
+path to another file under the input mount. To disable the policy globally,
+set top-level `ta-constraints-enabled = false` before `[[anchors]]`.
+See [configuration](../docs/configuration.md) and [Docker instructions](../docs/docker.md)
+for validation and stop/check/recreate steps. Files are re-read for each
+validation run; a running validation uses its loaded policy snapshot.
+
+## Updating the vendored snapshot
+
+1. Select and record a full OpenBSD commit SHA; fetch all ten files from that
+   same commit's `etc/rpki/` directory (never mix floating master revisions).
+2. Preserve bytes, filenames and notices; review TAL keys/URIs and every policy
+   change, including per-file notices. Update this provenance and `SHA256SUMS`.
+3. Run `cargo test --locked` and configuration checks for both all5 templates,
+   then validate output differences before deploying.
+4. Update operator-managed copies explicitly. Image upgrades must not overwrite
+   a user's edited constraints; keep backups to roll back policy changes.