Overview

Overview
--------

The setting `CIVICRM_SIGN_KEYS` was introduced circa 5.36.  However, it is
defined in `civicrm.settings.php`, which makes it difficult to reliably
configure in an automated upgrade.  Consequently, some sites may not have
this setting, and we must rely on the sysadmin to provide it.

The setting is required for the `crypto.jwt` API (which in turn is used by
some core extensions, like `authx` and `afform`).

Before
------

There is a pre-upgrade message when somebody passes through v5.36.

If you missed the message in 5.36, then you would be unaware of the missing
setting (until you hit some failure because you use some new/update
code-path that relies on it).

After
-----

There is a system status-check.  If you don't have `CIVICRM_SIGN_KEYS`, then
it will show a link to https://docs.civicrm.org/sysadmin/en/latest/setup/secret-keys/.