A word more on updating keys, and a cross-reference in a good place

doc/accounts.md

@@ -295,3 +295,7 @@ ticket for you. The sponsor should [create a new ticket in GitLab](https://gitla
    least one Tor person other than your sponsor.
  * The ticket should be OpenPGP signed with the current valid OpenPGP key of
    your sponsor.
+
+### Actually updating the keyring ###
+
+See the [new-user HOWTO](../howto/create-a-new-user.md).

howto/create-a-new-user.md

@@ -238,3 +238,6 @@ group of machines, as the `mirroradm` user:
 
 The account-keyring repository contains an update script `./UPDATE` which takes
 the ldap username as argument and automatically updates the key.
+
+If you /change/ a user's key (to a new primary key), you also need to update
+the user's ``keyFingerPrint`` attribute in LDAP.