add a way to pass "-k" to nsupdate, and document all options in the sample config...