code: func (c *initCmd) initSecretRing() error {
  	if secretRing, ok := osutil.ExplicitSecretRingFile(); ok {
  		c.secretRing = secretRing
  	} else {
  		if android.OnAndroid() {
  			panic("on android, so CAMLI_SECRET_RING should have been defined, or --secret-keyring used.")
  		}
  		c.secretRing = osutil.SecretRingFile()
  	}
  	if _, err := os.Stat(c.secretRing); err != nil {
  		hint := "\nA GPG key is required, please use 'pk-put init --newkey'.\n\nOr if you know what you're doing, you can set the global pk-put flag --secret-keyring, or the CAMLI_SECRET_RING env var, to use your own GPG ring. And --gpgkey=<pubid> or GPGKEY to select which key ID to use."
  		return fmt.Errorf("Could not use secret ring file %v: %v.\n%v", c.secretRing, err, hint)
  	}
  	return nil
  }
docs: // initSecretRing sets c.secretRing. It tries, in this order, the --secret-keyring flag,
  // the CAMLI_SECRET_RING env var, then defaults to the operating system dependent location
  // otherwise.
  // It returns an error if the file does not exist.