keymgr: add support for upgrade

doc/man/keymgr.8in

@@ -67,8 +67,12 @@ directory.
.INDENT 0.0
.TP
\fBinit\fP
-Initialize new KASP database. This also creates a default policy and default
-key store (both named \fIdefault\fP).
+Initialize new KASP database or upgrade existing one. The command is
+idempotent and therefore it is safe to be run multiple times.
+.sp
+The command creates a default policy and default key store (both named
+\fIdefault\fP). In case of upgrade, existing objects are checked and any missing
+attributes are filled in.
.TP
\fBzone\fP ...
Operations with zones in the database. A zone holds assigned signing