.Nd tinc VPN control
.Sh SYNOPSIS
.Nm
-.Op Fl cn
+.Op Fl bcn
.Op Fl -config Ns = Ns Ar DIR
.Op Fl -net Ns = Ns Ar NETNAME
.Op Fl -pidfile Ns = Ns Ar FILENAME
+.Op Fl -batch
.Op Fl -force
.Op Fl -help
.Op Fl -version
.Ar FILENAME
to authenticate with a running tinc daemon.
If unspecified, the default is
-.Pa @localstatedir@/run/tinc. Ns Ar NETNAME Ns Pa .pid.
+.Pa @runstatedir@/tinc. Ns Ar NETNAME Ns Pa .pid.
+.It Fl b, -batch
+Don't ask for anything (non-interactive mode).
.It Fl -force
Force some commands to work despite warnings.
.It Fl -help
.Sh COMMANDS
.Bl -tag -width indent
.It init Op Ar name
-Create initial configuration files and RSA and Ed25519 keypairs with default length.
+Create initial configuration files and RSA and Ed25519 key pairs with default length.
If no
.Ar name
for this node is given, it will be asked for.
Shows the PID of the currently running
.Xr tincd 8 .
.It generate-keys Op bits
-Generate both RSA and Ed25519 keypairs (see below) and exit.
+Generate both RSA and Ed25519 key pairs (see below) and exit.
.It generate-ed25519-keys
-Generate public/private Ed25519 keypair and exit.
+Generate public/private Ed25519 key pair and exit.
.It generate-rsa-keys Op bits
-Generate public/private RSA keypair and exit.
+Generate public/private RSA key pair and exit.
If
.Ar bits
is omitted, the default length will be 2048 bits.
If no
.Ar filename
is given, the file is read from standard input.
-If the verification is succesful,
+If the verification is successful,
a copy of the input with the signature removed is written to standard output,
and the exit code will be zero.
If the verification failed,