diff --git a/.mise-tasks/nauth/generate-docs.sh b/.mise-tasks/nauth/generate-docs.sh
index bd8155d4..5f4f36b2 100755
--- a/.mise-tasks/nauth/generate-docs.sh
+++ b/.mise-tasks/nauth/generate-docs.sh
@@ -12,6 +12,7 @@ crd-ref-docs \
     --source-path="$MISE_PROJECT_ROOT/api" \
     --config="$MISE_PROJECT_ROOT/api/config.yaml" \
     --renderer=markdown \
+    --templates-dir="$MISE_PROJECT_ROOT/api/templates/markdown" \
     --output-path="$crd_docs"
 
 # Add the required frontmatter for Starlight
diff --git a/api/config.yaml b/api/config.yaml
index e7442add..26d9e1d7 100644
--- a/api/config.yaml
+++ b/api/config.yaml
@@ -1,3 +1,7 @@
+processor:
+  ignoreFields:
+    - "TypeMeta$"
+
 render:
   kubernetesVersion: 1.36
   knownTypes:
diff --git a/api/templates/markdown/gv_details.tpl b/api/templates/markdown/gv_details.tpl
new file mode 100644
index 00000000..30ad0d75
--- /dev/null
+++ b/api/templates/markdown/gv_details.tpl
@@ -0,0 +1,19 @@
+{{- define "gvDetails" -}}
+{{- $gv := . -}}
+
+## {{ $gv.GroupVersionString }}
+
+{{ $gv.Doc }}
+
+{{- if $gv.Kinds  }}
+### Resource Types
+{{- range $gv.SortedKinds }}
+- {{ $gv.TypeForKind . | markdownRenderTypeLink }}
+{{- end }}
+{{ end }}
+
+{{ range $gv.SortedTypes }}
+{{ template "type" . }}
+{{ end }}
+
+{{- end -}}
diff --git a/api/templates/markdown/gv_list.tpl b/api/templates/markdown/gv_list.tpl
new file mode 100644
index 00000000..a4d3dadf
--- /dev/null
+++ b/api/templates/markdown/gv_list.tpl
@@ -0,0 +1,15 @@
+{{- define "gvList" -}}
+{{- $groupVersions := . -}}
+
+# API Reference
+
+## Packages
+{{- range $groupVersions }}
+- {{ markdownRenderGVLink . }}
+{{- end }}
+
+{{ range $groupVersions }}
+{{ template "gvDetails" . }}
+{{ end }}
+
+{{- end -}}
diff --git a/api/templates/markdown/type.tpl b/api/templates/markdown/type.tpl
new file mode 100644
index 00000000..6f3e9998
--- /dev/null
+++ b/api/templates/markdown/type.tpl
@@ -0,0 +1,60 @@
+{{- define "type" -}}
+{{- $type := . -}}
+{{- if markdownShouldRenderType $type -}}
+
+#### {{ $type.Name }}
+
+{{ if $type.IsAlias }}_Underlying type:_ _{{ markdownRenderTypeLink $type.UnderlyingType  }}_{{ end }}
+
+{{ $type.Doc }}
+
+{{ if $type.Validation -}}
+_Validation:_
+{{- range $type.Validation }}
+- {{ . }}
+{{- end }}
+{{- end }}
+
+{{ if $type.References -}}
+_Appears in:_
+{{- range $type.SortedReferences }}
+- {{ markdownRenderTypeLink . }}
+{{- end }}
+{{- end }}
+
+{{ if $type.Members -}}
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+{{ if $type.GVK -}}
+| `apiVersion` _string_ | `{{ $type.GVK.Group }}/{{ $type.GVK.Version }}` | | |
+| `kind` _string_ | `{{ $type.GVK.Kind }}` | | |
+{{ end -}}
+
+{{ range $type.Members -}}
+| `{{ .Name  }}` _{{ markdownRenderType .Type }}_ | {{ template "type_members" . }} | {{ markdownRenderDefault .Default }} | {{ template "field_validation" . }} |
+{{ end -}}
+
+{{ end -}}
+
+{{ if $type.EnumValues -}}
+| Field | Description |
+| --- | --- |
+{{ range $type.EnumValues -}}
+| `{{ .Name }}` | {{ markdownRenderFieldDoc .Doc }} |
+{{ end -}}
+{{ end -}}
+
+
+{{- end -}}
+{{- end -}}
+
+{{- define "field_validation" -}}
+{{- range (.Validation | uniq) -}}
+{{- if eq . "Optional: {}" -}}
+{{- else if eq . "Required: {}" -}}
+Required <br />
+{{- else -}}
+{{ markdownRenderFieldDoc . }} <br />
+{{- end -}}
+{{- end -}}
+{{- end -}}
diff --git a/api/templates/markdown/type_members.tpl b/api/templates/markdown/type_members.tpl
new file mode 100644
index 00000000..041758a8
--- /dev/null
+++ b/api/templates/markdown/type_members.tpl
@@ -0,0 +1,8 @@
+{{- define "type_members" -}}
+{{- $field := . -}}
+{{- if eq $field.Name "metadata" -}}
+Refer to Kubernetes API documentation for fields of `metadata`.
+{{- else -}}
+{{ markdownRenderFieldDoc $field.Doc }}
+{{- end -}}
+{{- end -}}
diff --git a/www/src/content/docs/crds.md b/www/src/content/docs/crds.md
index f4d3acf3..fd0618f8 100644
--- a/www/src/content/docs/crds.md
+++ b/www/src/content/docs/crds.md
@@ -19,6 +19,8 @@ Package v1alpha1 contains API schema definitions for the nauth.io v1alpha1 API g
 - [AccountImport](#accountimport)
 - [AccountImportList](#accountimportlist)
 - [AccountList](#accountlist)
+- [AccountSigningKey](#accountsigningkey)
+- [AccountSigningKeyList](#accountsigningkeylist)
 - [NatsCluster](#natscluster)
 - [NatsClusterList](#natsclusterlist)
 - [User](#user)
@@ -41,8 +43,6 @@ _Appears in:_
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `Account` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `spec` _[AccountSpec](#accountspec)_ |  |  |  |
 | `status` _[AccountStatus](#accountstatus)_ |  |  |  |
@@ -61,10 +61,10 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `name` _string_ | Name the child resource name |  | MinLength: 1 <br />Required: \{\} <br />Required: \{\} <br /> |
-| `uid` _[UID](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#uid-types-pkg)_ | UID of the child resource UID |  | Required: \{\} <br /> |
-| `observedGeneration` _integer_ | ObservedGeneration refers to the observed generation of the child resource. |  | Minimum: 0 <br />Required: \{\} <br /> |
-| `status` _[AccountAdoptionStatus](#accountadoptionstatus)_ | Status of the adoption |  | Required: \{\} <br /> |
+| `name` _string_ | Name the child resource name |  | MinLength: 1 <br />Required <br /> |
+| `uid` _[UID](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#uid-types-pkg)_ | UID of the child resource UID |  | Required <br /> |
+| `observedGeneration` _integer_ | ObservedGeneration refers to the observed generation of the child resource. |  | Minimum: 0 <br />Required <br /> |
+| `status` _[AccountAdoptionStatus](#accountadoptionstatus)_ | Status of the adoption |  | Required <br /> |
 
 
 #### AccountAdoptionStatus
@@ -80,10 +80,10 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `status` _[ConditionStatus](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#conditionstatus-v1-meta)_ | Status of the adoption, one of True, False, Unknown. |  | Enum: [True False Unknown] <br />Required: \{\} <br />Required: \{\} <br /> |
-| `desiredClaimObservedGeneration` _integer_ | DesiredClaimObservedGeneration refers to the observed generation of the child resource desired claim. |  | Minimum: 0 <br />Optional: \{\} <br /> |
-| `reason` _string_ | Reason contains a programmatic identifier indicating the reason for the adoption's last transition.<br />The value should be a CamelCase string.<br />This field may not be empty. |  | MaxLength: 1024 <br />MinLength: 1 <br />Pattern: `^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$` <br />Required: \{\} <br />Required: \{\} <br /> |
-| `message` _string_ | Message is a human-readable message indicating details about the adoption. |  | MaxLength: 32768 <br />Optional: \{\} <br /> |
+| `status` _[ConditionStatus](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#conditionstatus-v1-meta)_ | Status of the adoption, one of True, False, Unknown. |  | Enum: [True False Unknown] <br />Required <br /> |
+| `desiredClaimObservedGeneration` _integer_ | DesiredClaimObservedGeneration refers to the observed generation of the child resource desired claim. |  | Minimum: 0 <br /> |
+| `reason` _string_ | Reason contains a programmatic identifier indicating the reason for the adoption's last transition.<br />The value should be a CamelCase string.<br />This field may not be empty. |  | MaxLength: 1024 <br />MinLength: 1 <br />Pattern: `^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$` <br />Required <br /> |
+| `message` _string_ | Message is a human-readable message indicating details about the adoption. |  | MaxLength: 32768 <br /> |
 
 
 #### AccountAdoptions
@@ -99,8 +99,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `exports` _[AccountAdoption](#accountadoption) array_ | Exports defines adoptions of type `AccountExport` that are bound to the account. |  | Optional: \{\} <br /> |
-| `imports` _[AccountAdoption](#accountadoption) array_ | Imports defines adoptions of type `AccountImport` that are bound to the account. |  | Optional: \{\} <br /> |
+| `exports` _[AccountAdoption](#accountadoption) array_ | Exports defines adoptions of type `AccountExport` that are bound to the account. |  |  |
+| `imports` _[AccountAdoption](#accountadoption) array_ | Imports defines adoptions of type `AccountImport` that are bound to the account. |  |  |
 
 
 #### AccountClaims
@@ -116,14 +116,14 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `accountLimits` _[AccountLimits](#accountlimits)_ |  |  | Optional: \{\} <br /> |
-| `displayName` _string_ |  |  | Optional: \{\} <br /> |
-| `signingKeys` _[SigningKeys](#signingkeys)_ |  |  | Optional: \{\} <br /> |
-| `exports` _[Exports](#exports)_ |  |  | Optional: \{\} <br /> |
-| `imports` _[Imports](#imports)_ |  |  | Optional: \{\} <br /> |
-| `jetStreamEnabled` _boolean_ |  |  | Optional: \{\} <br /> |
-| `jetStreamLimits` _[JetStreamLimits](#jetstreamlimits)_ |  |  | Optional: \{\} <br /> |
-| `natsLimits` _[NatsLimits](#natslimits)_ |  |  | Optional: \{\} <br /> |
+| `accountLimits` _[AccountLimits](#accountlimits)_ |  |  |  |
+| `displayName` _string_ |  |  |  |
+| `signingKeys` _[SigningKeys](#signingkeys)_ |  |  |  |
+| `exports` _[Exports](#exports)_ |  |  |  |
+| `imports` _[Imports](#imports)_ |  |  |  |
+| `jetStreamEnabled` _boolean_ |  |  |  |
+| `jetStreamLimits` _[JetStreamLimits](#jetstreamlimits)_ |  |  |  |
+| `natsLimits` _[NatsLimits](#natslimits)_ |  |  |  |
 
 
 #### AccountExport
@@ -141,8 +141,6 @@ _Appears in:_
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `AccountExport` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `spec` _[AccountExportSpec](#accountexportspec)_ |  |  |  |
 | `status` _[AccountExportStatus](#accountexportstatus)_ |  |  |  |
@@ -161,8 +159,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `rules` _[AccountExportRule](#accountexportrule) array_ | Rules contains export rules that have been validated and are ready to be used by Account |  | MinItems: 1 <br />Required: \{\} <br /> |
-| `observedGeneration` _integer_ |  |  | Required: \{\} <br /> |
+| `rules` _[AccountExportRule](#accountexportrule) array_ | Rules contains export rules that have been validated and are ready to be used by Account |  | MinItems: 1 <br />Required <br /> |
+| `observedGeneration` _integer_ |  |  | Required <br /> |
 
 
 
@@ -181,8 +179,6 @@ AccountExportList contains a list of AccountExport.
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `AccountExportList` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `items` _[AccountExport](#accountexport) array_ |  |  |  |
 
@@ -201,15 +197,15 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `name` _string_ |  |  | Optional: \{\} <br /> |
-| `subject` _[Subject](#subject)_ |  |  | Required: \{\} <br /> |
-| `type` _[ExportType](#exporttype)_ |  |  | Enum: [stream service] <br />Required: \{\} <br /> |
-| `responseType` _[ResponseType](#responsetype)_ |  |  | Enum: [Singleton Stream Chunked] <br />Optional: \{\} <br /> |
-| `responseThreshold` _[Duration](#duration)_ |  |  | Optional: \{\} <br /> |
-| `serviceLatency` _[ServiceLatency](#servicelatency)_ |  |  | Optional: \{\} <br /> |
-| `accountTokenPosition` _integer_ |  |  | Optional: \{\} <br /> |
-| `advertise` _boolean_ |  |  | Optional: \{\} <br /> |
-| `allowTrace` _boolean_ |  |  | Optional: \{\} <br /> |
+| `name` _string_ |  |  |  |
+| `subject` _[Subject](#subject)_ |  |  | Required <br /> |
+| `type` _[ExportType](#exporttype)_ |  |  | Enum: [stream service] <br />Required <br /> |
+| `responseType` _[ResponseType](#responsetype)_ |  |  | Enum: [Singleton Stream Chunked] <br /> |
+| `responseThreshold` _[Duration](#duration)_ |  |  |  |
+| `serviceLatency` _[ServiceLatency](#servicelatency)_ |  |  |  |
+| `accountTokenPosition` _integer_ |  |  |  |
+| `advertise` _boolean_ |  |  |  |
+| `allowTrace` _boolean_ |  |  |  |
 
 
 #### AccountExportSpec
@@ -225,8 +221,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `accountName` _string_ | AccountName refers to the Account in the same namespace to which this export applies. |  | Required: \{\} <br /> |
-| `rules` _[AccountExportRule](#accountexportrule) array_ | Rules defines the export rules for this account export. Must have at least one rule. |  | MinItems: 1 <br />Required: \{\} <br /> |
+| `accountName` _string_ | AccountName refers to the Account in the same namespace to which this export applies. |  | Required <br /> |
+| `rules` _[AccountExportRule](#accountexportrule) array_ | Rules defines the export rules for this account export. Must have at least one rule. |  | MinItems: 1 <br />Required <br /> |
 
 
 #### AccountExportStatus
@@ -242,12 +238,12 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `accountID` _string_ | AccountID is the ID of the account that this export is bound to. |  | Optional: \{\} <br /> |
-| `desiredClaim` _[AccountExportClaim](#accountexportclaim)_ | Normalized claim for account to use |  | Optional: \{\} <br /> |
-| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  | Optional: \{\} <br /> |
-| `observedGeneration` _integer_ |  |  | Optional: \{\} <br /> |
-| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  | Optional: \{\} <br /> |
-| `operatorVersion` _string_ |  |  | Optional: \{\} <br /> |
+| `accountID` _string_ | AccountID is the ID of the account that this export is bound to. |  |  |
+| `desiredClaim` _[AccountExportClaim](#accountexportclaim)_ | Normalized claim for account to use |  |  |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  |  |
+| `observedGeneration` _integer_ |  |  |  |
+| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  |  |
+| `operatorVersion` _string_ |  |  |  |
 
 
 #### AccountImport
@@ -265,8 +261,6 @@ _Appears in:_
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `AccountImport` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `spec` _[AccountImportSpec](#accountimportspec)_ |  |  |  |
 | `status` _[AccountImportStatus](#accountimportstatus)_ |  |  |  |
@@ -285,8 +279,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `rules` _[AccountImportRuleDerived](#accountimportrulederived) array_ | Rules contains import rules that have been validated and are ready to be used by Account. |  | MinItems: 1 <br />Required: \{\} <br /> |
-| `observedGeneration` _integer_ |  |  | Required: \{\} <br /> |
+| `rules` _[AccountImportRuleDerived](#accountimportrulederived) array_ | Rules contains import rules that have been validated and are ready to be used by Account. |  | MinItems: 1 <br />Required <br /> |
+| `observedGeneration` _integer_ |  |  | Required <br /> |
 
 
 
@@ -305,8 +299,6 @@ AccountImportList contains a list of AccountImport.
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `AccountImportList` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `items` _[AccountImport](#accountimport) array_ |  |  |  |
 
@@ -325,12 +317,12 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `name` _string_ |  |  | Optional: \{\} <br /> |
-| `subject` _[Subject](#subject)_ | Subject is the exported subject to import.<br />It must be identical to or a subset of the exported subject. |  | Required: \{\} <br /> |
-| `localSubject` _[RenamingSubject](#renamingsubject)_ | LocalSubject remaps the imported subject locally in the importing account. |  | Optional: \{\} <br /> |
-| `type` _[ExportType](#exporttype)_ | Type defines whether the import is a stream or service import. |  | Enum: [stream service] <br />Required: \{\} <br /> |
-| `share` _boolean_ |  |  | Optional: \{\} <br /> |
-| `allowTrace` _boolean_ |  |  | Optional: \{\} <br /> |
+| `name` _string_ |  |  |  |
+| `subject` _[Subject](#subject)_ | Subject is the exported subject to import.<br />It must be identical to or a subset of the exported subject. |  | Required <br /> |
+| `localSubject` _[RenamingSubject](#renamingsubject)_ | LocalSubject remaps the imported subject locally in the importing account. |  |  |
+| `type` _[ExportType](#exporttype)_ | Type defines whether the import is a stream or service import. |  | Enum: [stream service] <br />Required <br /> |
+| `share` _boolean_ |  |  |  |
+| `allowTrace` _boolean_ |  |  |  |
 
 
 #### AccountImportRuleDerived
@@ -346,13 +338,13 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `name` _string_ |  |  | Optional: \{\} <br /> |
-| `subject` _[Subject](#subject)_ | Subject is the exported subject to import.<br />It must be identical to or a subset of the exported subject. |  | Required: \{\} <br /> |
-| `localSubject` _[RenamingSubject](#renamingsubject)_ | LocalSubject remaps the imported subject locally in the importing account. |  | Optional: \{\} <br /> |
-| `type` _[ExportType](#exporttype)_ | Type defines whether the import is a stream or service import. |  | Enum: [stream service] <br />Required: \{\} <br /> |
-| `share` _boolean_ |  |  | Optional: \{\} <br /> |
-| `allowTrace` _boolean_ |  |  | Optional: \{\} <br /> |
-| `account` _string_ | Account is the resolved export account ID used for this import rule. |  | Required: \{\} <br /> |
+| `name` _string_ |  |  |  |
+| `subject` _[Subject](#subject)_ | Subject is the exported subject to import.<br />It must be identical to or a subset of the exported subject. |  | Required <br /> |
+| `localSubject` _[RenamingSubject](#renamingsubject)_ | LocalSubject remaps the imported subject locally in the importing account. |  |  |
+| `type` _[ExportType](#exporttype)_ | Type defines whether the import is a stream or service import. |  | Enum: [stream service] <br />Required <br /> |
+| `share` _boolean_ |  |  |  |
+| `allowTrace` _boolean_ |  |  |  |
+| `account` _string_ | Account is the resolved export account ID used for this import rule. |  | Required <br /> |
 
 
 #### AccountImportSpec
@@ -368,9 +360,9 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `accountName` _string_ | AccountName refers to the Account in the same namespace to which this import applies. |  | Required: \{\} <br /> |
-| `exportAccountRef` _[AccountRef](#accountref)_ | ExportAccountRef refers to the Account from which the exports are imported.<br />This reference may point to an Account in another namespace. |  | Required: \{\} <br /> |
-| `rules` _[AccountImportRule](#accountimportrule) array_ | Rules defines the import rules for this AccountImport. |  | MinItems: 1 <br />Required: \{\} <br /> |
+| `accountName` _string_ | AccountName refers to the Account in the same namespace to which this import applies. |  | Required <br /> |
+| `exportAccountRef` _[AccountRef](#accountref)_ | ExportAccountRef refers to the Account from which the exports are imported.<br />This reference may point to an Account in another namespace. |  | Required <br /> |
+| `rules` _[AccountImportRule](#accountimportrule) array_ | Rules defines the import rules for this AccountImport. |  | MinItems: 1 <br />Required <br /> |
 
 
 #### AccountImportStatus
@@ -386,13 +378,13 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `accountID` _string_ | AccountID is the resolved ID of the Account referenced by spec.accountName. |  | Optional: \{\} <br /> |
-| `exportAccountID` _string_ | ExportAccountID is the resolved ID of the Account referenced by spec.exportAccountRef. |  | Optional: \{\} <br /> |
-| `desiredClaim` _[AccountImportClaim](#accountimportclaim)_ | DesiredClaim is the normalized claim for Account to use. |  | Optional: \{\} <br /> |
-| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  | Optional: \{\} <br /> |
-| `observedGeneration` _integer_ |  |  | Optional: \{\} <br /> |
-| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  | Optional: \{\} <br /> |
-| `operatorVersion` _string_ |  |  | Optional: \{\} <br /> |
+| `accountID` _string_ | AccountID is the resolved ID of the Account referenced by spec.accountName. |  |  |
+| `exportAccountID` _string_ | ExportAccountID is the resolved ID of the Account referenced by spec.exportAccountRef. |  |  |
+| `desiredClaim` _[AccountImportClaim](#accountimportclaim)_ | DesiredClaim is the normalized claim for Account to use. |  |  |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  |  |
+| `observedGeneration` _integer_ |  |  |  |
+| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  |  |
+| `operatorVersion` _string_ |  |  |  |
 
 
 
@@ -411,11 +403,11 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `imports` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `exports` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `wildcards` _boolean_ |  | true | Optional: \{\} <br /> |
-| `conn` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `leaf` _integer_ |  | -1 | Optional: \{\} <br /> |
+| `imports` _integer_ |  | -1 |  |
+| `exports` _integer_ |  | -1 |  |
+| `wildcards` _boolean_ |  | true |  |
+| `conn` _integer_ |  | -1 |  |
+| `leaf` _integer_ |  | -1 |  |
 
 
 #### AccountList
@@ -432,8 +424,6 @@ AccountList contains a list of Account.
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `AccountList` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `items` _[Account](#account) array_ |  |  |  |
 
@@ -456,6 +446,130 @@ _Appears in:_
 | `namespace` _string_ |  |  |  |
 
 
+#### AccountSigningKey
+
+
+
+AccountSigningKey manages one NATS account signing-key seed in a Kubernetes Secret.
+By default NAuth manages the signing key seed: it generates a new key and stores it in
+a Secret named spec.secretName (defaulting to <resourceName>-ac-sign). The Secret is
+owned by this resource and garbage-collected when the resource is deleted.
+
+In observe mode (label nauth.io/management-policy=observe), NAuth only reads an existing
+Secret with the resolved name and derives the public key. Observed Secrets are not
+modified, owned, or deleted by the operator.
+
+An Account trusts the public key by listing this resource in Account.spec.signingKeyRefs.
+
+
+
+_Appears in:_
+- [AccountSigningKeyList](#accountsigningkeylist)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
+| `kind` _string_ | `AccountSigningKey` | | |
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
+| `spec` _[AccountSigningKeySpec](#accountsigningkeyspec)_ |  |  |  |
+| `status` _[AccountSigningKeyStatus](#accountsigningkeystatus)_ |  |  |  |
+
+
+#### AccountSigningKeyList
+
+
+
+AccountSigningKeyList contains a list of AccountSigningKey.
+
+
+
+
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
+| `kind` _string_ | `AccountSigningKeyList` | | |
+| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
+| `items` _[AccountSigningKey](#accountsigningkey) array_ |  |  |  |
+
+
+#### AccountSigningKeyRef
+
+
+
+AccountSigningKeyRef references a signing-key resource whose public key is
+trusted by the Account (and may be used to sign Users). Only AccountSigningKey
+is supported; Kind is reserved for future kinds (e.g. issuers).
+
+
+
+_Appears in:_
+- [AccountSpec](#accountspec)
+- [UserSpec](#userspec)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `kind` _[AccountSigningKeyRefKind](#accountsigningkeyrefkind)_ | Kind of the referenced resource. Defaults to AccountSigningKey. | AccountSigningKey | Enum: [AccountSigningKey] <br /> |
+| `name` _string_ | Name of the referenced resource. |  | MaxLength: 253 <br />MinLength: 1 <br />Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?$` <br />Required <br /> |
+| `namespace` _string_ | Namespace of the referenced resource. When empty, defaults to the<br />referrer's namespace. Cross-namespace references let multiple Accounts<br />trust a shared signing key (e.g. a cluster-wide Auth Callout service). |  | MaxLength: 253 <br />Pattern: `^([a-z0-9]([-a-z0-9]*[a-z0-9])?)?$` <br /> |
+
+
+#### AccountSigningKeyRefKind
+
+_Underlying type:_ _string_
+
+AccountSigningKeyRefKind is the kind of resource referenced as an account
+signing key.
+
+_Validation:_
+- Enum: [AccountSigningKey]
+
+_Appears in:_
+- [AccountSigningKeyRef](#accountsigningkeyref)
+
+| Field | Description |
+| --- | --- |
+| `AccountSigningKey` |  |
+
+
+#### AccountSigningKeySpec
+
+
+
+AccountSigningKeySpec defines the desired state of AccountSigningKey.
+
+
+
+_Appears in:_
+- [AccountSigningKey](#accountsigningkey)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `secretName` _string_ | SecretName names the Kubernetes Secret that holds the account signing-key seed.<br />In managed mode (default), SecretName is optional and defaults to<br /><resourceName>-ac-sign; the Secret is created and owned by this AccountSigningKey.<br />In observe mode (label nauth.io/management-policy=observe), SecretName is<br />required and identifies the existing Secret to read; the operator never falls<br />back to the managed default name and never modifies the Secret.<br />Immutable. |  | MaxLength: 253 <br />Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?$` <br /> |
+
+
+#### AccountSigningKeyStatus
+
+
+
+AccountSigningKeyStatus defines the observed state of AccountSigningKey.
+
+
+
+_Appears in:_
+- [AccountSigningKey](#accountsigningkey)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `publicKey` _string_ | PublicKey is the resolved NATS public key (A-prefixed nkey) for this signing key. |  |  |
+| `secretName` _string_ | SecretName is the resolved name of the Secret holding the seed. |  |  |
+| `managementPolicy` _string_ | ManagementPolicy reflects the effective management policy for this resource.<br />Empty means managed (default); "observe" means the Secret is only read. |  |  |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  |  |
+| `observedGeneration` _integer_ |  |  |  |
+| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  |  |
+| `operatorVersion` _string_ |  |  |  |
+
+
 #### AccountSpec
 
 
@@ -469,14 +583,15 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `natsClusterRef` _[NatsClusterRef](#natsclusterref)_ | NatsClusterRef references the NatsCluster to use for this account.<br />If not specified, the controller uses the operator-level NATS_CLUSTER_REF when configured.<br />Otherwise, reconciliation fails because the target NatsCluster cannot be resolved. |  | Optional: \{\} <br /> |
-| `displayName` _string_ | DisplayName is an optional name for the NATS resource representing the account. May be derived if absent. |  | Optional: \{\} <br /> |
-| `jetStreamEnabled` _boolean_ | JetStreamEnabled indicates whether JetStream should be explicitly enabled or disabled.<br />If absent, JetStream will be implicitly enabled/disabled based on the effective JetStreamLimits. |  | Optional: \{\} <br /> |
-| `accountLimits` _[AccountLimits](#accountlimits)_ |  |  | Optional: \{\} <br /> |
-| `exports` _[Exports](#exports)_ |  |  | Optional: \{\} <br /> |
-| `imports` _[Imports](#imports)_ |  |  | Optional: \{\} <br /> |
-| `jetStreamLimits` _[JetStreamLimits](#jetstreamlimits)_ |  |  | Optional: \{\} <br /> |
-| `natsLimits` _[NatsLimits](#natslimits)_ |  |  | Optional: \{\} <br /> |
+| `natsClusterRef` _[NatsClusterRef](#natsclusterref)_ | NatsClusterRef references the NatsCluster to use for this account.<br />If not specified, the controller uses the operator-level NATS_CLUSTER_REF when configured.<br />Otherwise, reconciliation fails because the target NatsCluster cannot be resolved. |  |  |
+| `displayName` _string_ | DisplayName is an optional name for the NATS resource representing the account. May be derived if absent. |  |  |
+| `jetStreamEnabled` _boolean_ | JetStreamEnabled indicates whether JetStream should be explicitly enabled or disabled.<br />If absent, JetStream will be implicitly enabled/disabled based on the effective JetStreamLimits. |  |  |
+| `accountLimits` _[AccountLimits](#accountlimits)_ |  |  |  |
+| `exports` _[Exports](#exports)_ |  |  |  |
+| `imports` _[Imports](#imports)_ |  |  |  |
+| `jetStreamLimits` _[JetStreamLimits](#jetstreamlimits)_ |  |  |  |
+| `natsLimits` _[NatsLimits](#natslimits)_ |  |  |  |
+| `signingKeyRefs` _[AccountSigningKeyRef](#accountsigningkeyref) array_ | SigningKeyRefs lists references whose public keys are trusted as additional<br />signing keys for this account. The implicit default signing key is always<br />present and is not listed here. |  | MaxItems: 64 <br /> |
 
 
 #### AccountStatus
@@ -492,13 +607,13 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `claims` _[AccountClaims](#accountclaims)_ |  |  | Optional: \{\} <br /> |
-| `claimsHash` _string_ | ClaimsHash is a hash of the Account JWT claims, used to determine if the claims have changed and a new JWT needs to be generated. |  | Optional: \{\} <br /> |
-| `adoptions` _[AccountAdoptions](#accountadoptions)_ |  |  | Optional: \{\} <br /> |
-| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  | Optional: \{\} <br /> |
-| `observedGeneration` _integer_ |  |  | Optional: \{\} <br /> |
-| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  | Optional: \{\} <br /> |
-| `operatorVersion` _string_ |  |  | Optional: \{\} <br /> |
+| `claims` _[AccountClaims](#accountclaims)_ |  |  |  |
+| `claimsHash` _string_ | ClaimsHash is a hash of the Account JWT claims, used to determine if the claims have changed and a new JWT needs to be generated. |  |  |
+| `adoptions` _[AccountAdoptions](#accountadoptions)_ |  |  |  |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  |  |
+| `observedGeneration` _integer_ |  |  |  |
+| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  |  |
+| `operatorVersion` _string_ |  |  |  |
 
 
 #### CIDRList
@@ -652,14 +767,14 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `memStorage` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `diskStorage` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `streams` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `consumer` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `maxAckPending` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `memMaxStreamBytes` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `diskMaxStreamBytes` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `maxBytesRequired` _boolean_ |  | false | Optional: \{\} <br /> |
+| `memStorage` _integer_ |  | -1 |  |
+| `diskStorage` _integer_ |  | -1 |  |
+| `streams` _integer_ |  | -1 |  |
+| `consumer` _integer_ |  | -1 |  |
+| `maxAckPending` _integer_ |  | -1 |  |
+| `memMaxStreamBytes` _integer_ |  | -1 |  |
+| `diskMaxStreamBytes` _integer_ |  | -1 |  |
+| `maxBytesRequired` _boolean_ |  | false |  |
 
 
 #### NatsCluster
@@ -677,8 +792,6 @@ _Appears in:_
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `NatsCluster` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `spec` _[NatsClusterSpec](#natsclusterspec)_ |  |  |  |
 | `status` _[NatsClusterStatus](#natsclusterstatus)_ |  |  |  |
@@ -698,8 +811,6 @@ NatsClusterList contains a list of NatsCluster
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `NatsClusterList` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `items` _[NatsCluster](#natscluster) array_ |  |  |  |
 
@@ -718,7 +829,7 @@ _Appears in:_
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
 | `name` _string_ | Name of the NatsCluster |  |  |
-| `namespace` _string_ | Namespace of the NatsCluster |  | Optional: \{\} <br /> |
+| `namespace` _string_ | Namespace of the NatsCluster |  |  |
 
 
 #### NatsClusterSpec
@@ -734,8 +845,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `url` _string_ | URL is the NATS server URL for this cluster. Mutually exclusive with urlFrom. |  | Optional: \{\} <br /> |
-| `urlFrom` _[URLFromReference](#urlfromreference)_ | URLFrom loads the NATS URL from a ConfigMap or Secret. Mutually exclusive with url. |  | Optional: \{\} <br /> |
+| `url` _string_ | URL is the NATS server URL for this cluster. Mutually exclusive with urlFrom. |  |  |
+| `urlFrom` _[URLFromReference](#urlfromreference)_ | URLFrom loads the NATS URL from a ConfigMap or Secret. Mutually exclusive with url. |  |  |
 | `operatorSigningKeySecretRef` _[SecretKeyReference](#secretkeyreference)_ |  |  |  |
 | `systemAccountUserCredsSecretRef` _[SecretKeyReference](#secretkeyreference)_ |  |  |  |
 
@@ -753,10 +864,10 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  | Optional: \{\} <br /> |
-| `observedGeneration` _integer_ |  |  | Optional: \{\} <br /> |
-| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  | Optional: \{\} <br /> |
-| `operatorVersion` _string_ |  |  | Optional: \{\} <br /> |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  |  |
+| `observedGeneration` _integer_ |  |  |  |
+| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  |  |
+| `operatorVersion` _string_ |  |  |  |
 
 
 #### NatsLimits
@@ -775,9 +886,9 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `subs` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `data` _integer_ |  | -1 | Optional: \{\} <br /> |
-| `payload` _integer_ |  | -1 | Optional: \{\} <br /> |
+| `subs` _integer_ |  | -1 |  |
+| `data` _integer_ |  | -1 |  |
+| `payload` _integer_ |  | -1 |  |
 
 
 #### Permission
@@ -793,8 +904,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `allow` _[StringList](#stringlist)_ |  |  | Optional: \{\} <br /> |
-| `deny` _[StringList](#stringlist)_ |  |  | Optional: \{\} <br /> |
+| `allow` _[StringList](#stringlist)_ |  |  |  |
+| `deny` _[StringList](#stringlist)_ |  |  |  |
 
 
 #### Permissions
@@ -811,9 +922,9 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `pub` _[Permission](#permission)_ |  |  | Optional: \{\} <br /> |
-| `sub` _[Permission](#permission)_ |  |  | Optional: \{\} <br /> |
-| `resp` _[ResponsePermission](#responsepermission)_ |  |  | Optional: \{\} <br /> |
+| `pub` _[Permission](#permission)_ |  |  |  |
+| `sub` _[Permission](#permission)_ |  |  |  |
+| `resp` _[ResponsePermission](#responsepermission)_ |  |  |  |
 
 
 #### RenamingSubject
@@ -845,8 +956,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `max` _integer_ |  |  | Optional: \{\} <br /> |
-| `ttl` _[Duration](#duration)_ |  |  | Optional: \{\} <br /> |
+| `max` _integer_ |  |  |  |
+| `ttl` _[Duration](#duration)_ |  |  |  |
 
 
 #### ResponseType
@@ -903,8 +1014,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `name` _string_ | Name of the Secret. |  | Required: \{\} <br /> |
-| `key` _string_ | Key in the Secret, when not specified an implementation-specific default key is used. |  | Optional: \{\} <br /> |
+| `name` _string_ | Name of the Secret. |  | Required <br /> |
+| `key` _string_ | Key in the Secret, when not specified an implementation-specific default key is used. |  |  |
 
 
 #### ServiceLatency
@@ -1051,10 +1162,10 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `kind` _[URLFromKind](#urlfromkind)_ | Kind is the type of resource to load from: ConfigMap or Secret. |  | Enum: [ConfigMap Secret] <br />Required: \{\} <br /> |
-| `name` _string_ | Name of the ConfigMap or Secret. |  | Required: \{\} <br /> |
-| `namespace` _string_ | Namespace of the resource. When empty, defaults to the NatsCluster's namespace. |  | Optional: \{\} <br /> |
-| `key` _string_ | Key in the ConfigMap or Secret whose value is the NATS URL. |  | Required: \{\} <br /> |
+| `kind` _[URLFromKind](#urlfromkind)_ | Kind is the type of resource to load from: ConfigMap or Secret. |  | Enum: [ConfigMap Secret] <br />Required <br /> |
+| `name` _string_ | Name of the ConfigMap or Secret. |  | Required <br /> |
+| `namespace` _string_ | Namespace of the resource. When empty, defaults to the NatsCluster's namespace. |  |  |
+| `key` _string_ | Key in the ConfigMap or Secret whose value is the NATS URL. |  | Required <br /> |
 
 
 #### User
@@ -1072,8 +1183,6 @@ _Appears in:_
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `User` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `spec` _[UserSpec](#userspec)_ |  |  |  |
 | `status` _[UserStatus](#userstatus)_ |  |  |  |
@@ -1092,12 +1201,12 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `accountName` _string_ | Deprecated. Will be removed in a future release (>v0.5.0). Ref: https://github.com/WirelessCar/nauth/issues/102 |  | Optional: \{\} <br /> |
-| `displayName` _string_ | DisplayName is an optional name for the NATS resource representing the user. |  | Optional: \{\} <br /> |
-| `expiresAt` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ | ExpiresAt is the absolute time when the generated user JWT expires. |  | Optional: \{\} <br /> |
-| `permissions` _[Permissions](#permissions)_ |  |  | Optional: \{\} <br /> |
-| `natsLimits` _[NatsLimits](#natslimits)_ |  |  | Optional: \{\} <br /> |
-| `userLimits` _[UserLimits](#userlimits)_ |  |  | Optional: \{\} <br /> |
+| `accountName` _string_ | Deprecated. Will be removed in a future release (>v0.5.0). Ref: https://github.com/WirelessCar/nauth/issues/102 |  |  |
+| `displayName` _string_ | DisplayName is an optional name for the NATS resource representing the user. |  |  |
+| `expiresAt` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ | ExpiresAt is the absolute time when the generated user JWT expires. |  |  |
+| `permissions` _[Permissions](#permissions)_ |  |  |  |
+| `natsLimits` _[NatsLimits](#natslimits)_ |  |  |  |
+| `userLimits` _[UserLimits](#userlimits)_ |  |  |  |
 
 
 
@@ -1116,9 +1225,9 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `src` _[CIDRList](#cidrlist)_ | Src is a comma separated list of CIDR specifications |  | Optional: \{\} <br /> |
-| `times` _[TimeRange](#timerange) array_ |  |  | Optional: \{\} <br /> |
-| `timesLocation` _string_ |  |  | Optional: \{\} <br /> |
+| `src` _[CIDRList](#cidrlist)_ | Src is a comma separated list of CIDR specifications |  |  |
+| `times` _[TimeRange](#timerange) array_ |  |  |  |
+| `timesLocation` _string_ |  |  |  |
 
 
 #### UserList
@@ -1135,8 +1244,6 @@ UserList contains a list of User.
 | --- | --- | --- | --- |
 | `apiVersion` _string_ | `nauth.io/v1alpha1` | | |
 | `kind` _string_ | `UserList` | | |
-| `kind` _string_ | Kind is a string value representing the REST resource this object represents.<br />Servers may infer this from the endpoint the client submits requests to.<br />Cannot be updated.<br />In CamelCase.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |  | Optional: \{\} <br /> |
-| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.<br />Servers should convert recognized schemas to the latest internal value, and<br />may reject unrecognized values.<br />More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |  | Optional: \{\} <br /> |
 | `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
 | `items` _[User](#user) array_ |  |  |  |
 
@@ -1155,11 +1262,12 @@ _Appears in:_
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
 | `accountName` _string_ | AccountName references the account used to create the user. |  |  |
-| `displayName` _string_ | DisplayName is an optional name for the NATS resource representing the user. May be derived if absent. |  | Optional: \{\} <br /> |
-| `expiresAt` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ | ExpiresAt is an optional absolute time when the generated user JWT expires. |  | Optional: \{\} <br /> |
-| `permissions` _[Permissions](#permissions)_ |  |  | Optional: \{\} <br /> |
-| `userLimits` _[UserLimits](#userlimits)_ |  |  | Optional: \{\} <br /> |
-| `natsLimits` _[NatsLimits](#natslimits)_ |  |  | Optional: \{\} <br /> |
+| `displayName` _string_ | DisplayName is an optional name for the NATS resource representing the user. May be derived if absent. |  |  |
+| `expiresAt` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ | ExpiresAt is an optional absolute time when the generated user JWT expires. |  |  |
+| `permissions` _[Permissions](#permissions)_ |  |  |  |
+| `userLimits` _[UserLimits](#userlimits)_ |  |  |  |
+| `natsLimits` _[NatsLimits](#natslimits)_ |  |  |  |
+| `signingKeyRef` _[AccountSigningKeyRef](#accountsigningkeyref)_ | SigningKeyRef optionally references the signing key used to sign this User's<br />JWT. When absent, the Account's implicit signing key is used. The referenced<br />AccountSigningKey's public key must appear in Account.status.claims.signingKeys<br />at reconciliation time. |  |  |
 
 
 #### UserStatus
@@ -1175,8 +1283,8 @@ _Appears in:_
 
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
-| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  | Optional: \{\} <br /> |
-| `claims` _[UserClaims](#userclaims)_ |  |  | Optional: \{\} <br /> |
-| `observedGeneration` _integer_ |  |  | Optional: \{\} <br /> |
-| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  | Optional: \{\} <br /> |
-| `operatorVersion` _string_ |  |  | Optional: \{\} <br /> |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#condition-v1-meta) array_ |  |  |  |
+| `claims` _[UserClaims](#userclaims)_ |  |  |  |
+| `observedGeneration` _integer_ |  |  |  |
+| `reconcileTimestamp` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#time-v1-meta)_ |  |  |  |
+| `operatorVersion` _string_ |  |  |  |