sq: Reorder top-level subcommands.

  - The order of top-level subcommands is:

      - Encryption & decryption             (1xx)
      - Signing & verification              (2xx)
      - Key & cert-ring management          (3xx)
      - Key discovery & networking          (4xx)
      - Armor                               (5xx)
      - Inspection & packet manipulation    (6xx)

2 files changed, 288 insertions, 270 deletions

diff --git a/sq/src/sq-usage.rs b/sq/src/sq-usage.rs
index 40368991..f2a4e121 100644
--- a/sq/src/sq-usage.rs
+++ b/sq/src/sq-usage.rs
@@ -21,53 +21,22 @@
 //!     -p, --policy <NETWORK-POLICY>         Sets the network policy to use
 //!
 //! SUBCOMMANDS:
-//!     decrypt             Decrypts an OpenPGP message
 //!     encrypt             Encrypts a message
+//!     decrypt             Decrypts an OpenPGP message
 //!     sign                Signs a message
 //!     verify              Verifies a message
 //!     merge-signatures    Merges two signatures
-//!     keyserver           Interacts with keyservers
-//!     autocrypt           Autocrypt support
+//!     key                 Manipulates keys
 //!     certring            Manipulates certificate rings
-//!     dearmor             Removes ASCII Armor from a file
+//!     autocrypt           Autocrypt support
+//!     keyserver           Interacts with keyservers
+//!     wkd                 Interacts with Web Key Directories
 //!     enarmor             Applies ASCII Armor to a file
-//!     help                Prints this message or the help of the given
-//!                         subcommand(s)
+//!     dearmor             Removes ASCII Armor from a file
 //!     inspect             Inspects a sequence of OpenPGP packets
-//!     key                 Manipulates keys
 //!     packet              OpenPGP Packet manipulation
-//!     wkd                 Interacts with Web Key Directories
-//! ```
-//!
-//! ## Subcommand decrypt
-//!
-//! ```text
-//! Decrypts an OpenPGP message
-//!
-//! USAGE:
-//!     sq decrypt [FLAGS] [OPTIONS] [--] [FILE]
-//!
-//! FLAGS:
-//!         --dump                Print a packet dump to stderr
-//!         --dump-session-key    Prints the session key to stderr
-//!     -h, --help                Prints help information
-//!     -x, --hex                 Print a hexdump (implies --dump)
-//!     -V, --version             Prints version information
-//!
-//! OPTIONS:
-//!     -o, --output <FILE>             Sets the output file to use
-//!         --recipient-key <KEY>...
-//!             Secret key to decrypt with, given as a file (can be given multiple
-//!             times)
-//!         --signer-cert <CERT>...
-//!             The signer's certificate to verify signatures with, given as a file
-//!             (can be given multiple times)
-//!     -n, --signatures <N>
-//!             The number of valid signatures required.  Default: 0
-//!
-//!
-//! ARGS:
-//!     <FILE>    Sets the input file to use
+//!     help                Prints this message or the help of the given
+//!                         subcommand(s)
 //! ```
 //!
 //! ## Subcommand encrypt
@@ -113,6 +82,37 @@
 //!     <FILE>    Sets the input file to use
 //! ```
 //!
+//! ## Subcommand decrypt
+//!
+//! ```text
+//! Decrypts an OpenPGP message
+//!
+//! USAGE:
+//!     sq decrypt [FLAGS] [OPTIONS] [--] [FILE]
+//!
+//! FLAGS:
+//!         --dump                Print a packet dump to stderr
+//!         --dump-session-key    Prints the session key to stderr
+//!     -h, --help                Prints help information
+//!     -x, --hex                 Print a hexdump (implies --dump)
+//!     -V, --version             Prints version information
+//!
+//! OPTIONS:
+//!     -o, --output <FILE>             Sets the output file to use
+//!         --recipient-key <KEY>...
+//!             Secret key to decrypt with, given as a file (can be given multiple
+//!             times)
+//!         --signer-cert <CERT>...
+//!             The sender's certificate to verify signatures with, given as a file
+//!             (can be given multiple times)
+//!     -n, --signatures <N>
+//!             The number of valid signatures required.  Default: 0
+//!
+//!
+//! ARGS:
+//!     <FILE>    Sets the input file to use
+//! ```
+//!
 //! ## Subcommand sign
 //!
 //! ```text
@@ -158,7 +158,7 @@
 //!         --detached <SIG>           Verifies a detached signature
 //!     -o, --output <FILE>            Sets the output file to use
 //!         --signer-cert <CERT>...
-//!             The signer's certificate to verify signatures with, given as a file
+//!             The sender's certificate to verify signatures with, given as a file
 //!             (can be given multiple times)
 //!     -n, --signatures <N>
 //!             The number of valid signatures required.  Default: 0
@@ -188,126 +188,111 @@
 //!     <FILE>    Sets the second input file to use
 //! ```
 //!
-//! ## Subcommand keyserver
+//! ## Subcommand key
 //!
 //! ```text
-//! Interacts with keyservers
+//! Manipulates keys
 //!
 //! USAGE:
-//!     sq keyserver [OPTIONS] <SUBCOMMAND>
+//!     sq key <SUBCOMMAND>
 //!
 //! FLAGS:
 //!     -h, --help       Prints help information
 //!     -V, --version    Prints version information
 //!
-//! OPTIONS:
-//!     -s, --server <URI>    Sets the keyserver to use
-//!
 //! SUBCOMMANDS:
-//!     get     Retrieves a key
-//!     help    Prints this message or the help of the given subcommand(s)
-//!     send    Sends a key
-//! ```
-//!
-//! ### Subcommand keyserver get
-//!
-//! ```text
-//! Retrieves a key
-//!
-//! USAGE:
-//!     sq keyserver get [FLAGS] [OPTIONS] <QUERY>
-//!
-//! FLAGS:
-//!     -B, --binary     Don't ASCII-armor encode the OpenPGP data
-//!     -h, --help       Prints help information
-//!     -V, --version    Prints version information
-//!
-//! OPTIONS:
-//!     -o, --output <FILE>    Sets the output file to use
+//!     adopt                    Bind keys from one certificate to another.
+//!     attest-certifications
+//!             Attests third-party certifications allowing for their distribution
 //!
-//! ARGS:
-//!     <QUERY>    Fingerprint, KeyID, or email address of the cert(s) to
-//!                retrieve
+//!     generate                 Generates a new key
+//!     help
+//!             Prints this message or the help of the given subcommand(s)
 //! ```
 //!
-//! ### Subcommand keyserver send
+//! ### Subcommand key adopt
 //!
 //! ```text
-//! Sends a key
+//! Bind keys from one certificate to another.
 //!
 //! USAGE:
-//!     sq keyserver send [FILE]
+//!     sq key adopt [FLAGS] [OPTIONS] <CERT> --key <KEY>...
 //!
 //! FLAGS:
-//!     -h, --help       Prints help information
-//!     -V, --version    Prints version information
-//!
-//! ARGS:
-//!     <FILE>    Sets the input file to use
-//! ```
+//!         --allow-broken-crypto
+//!             Allows adopting keys from certificates using broken cryptography.
 //!
-//! ## Subcommand autocrypt
+//!     -h, --help                   Prints help information
+//!     -V, --version                Prints version information
 //!
-//! ```text
-//! Autocrypt support
+//! OPTIONS:
+//!     -k, --key <KEY>...
+//!             Adds the specified key or subkey to the certificate.
 //!
-//! USAGE:
-//!     sq autocrypt <SUBCOMMAND>
+//!     -r, --keyring <KEYRING>...
+//!             A keyring containing the keys specified in --key.
 //!
-//! FLAGS:
-//!     -h, --help       Prints help information
-//!     -V, --version    Prints version information
 //!
-//! SUBCOMMANDS:
-//!     decode           Converts Autocrypt-encoded keys to OpenPGP Certificates
-//!     encode-sender    Encodes the sender's OpenPGP Certificates into an
-//!                      Autocrypt header
-//!     help             Prints this message or the help of the given
-//!                      subcommand(s)
+//! ARGS:
+//!     <CERT>    The certificate to add keys to.
 //! ```
 //!
-//! ### Subcommand autocrypt decode
+//! ### Subcommand key attest-certifications
 //!
 //! ```text
-//! Converts Autocrypt-encoded keys to OpenPGP Certificates
+//! Attests third-party certifications allowing for their distribution
 //!
 //! USAGE:
-//!     sq autocrypt decode [OPTIONS] [FILE]
+//!     sq key attest-certifications [FLAGS] <KEY>
 //!
 //! FLAGS:
+//!         --all        Attest to all certifications
 //!     -h, --help       Prints help information
+//!         --none       Remove all prior attestations
 //!     -V, --version    Prints version information
 //!
-//! OPTIONS:
-//!     -o, --output <FILE>    Sets the output file to use
-//!
 //! ARGS:
-//!     <FILE>    Sets the input file to use
+//!     <KEY>    Change attestations on this key.
 //! ```
 //!
-//! ### Subcommand autocrypt encode-sender
+//! ### Subcommand key generate
 //!
 //! ```text
-//! Encodes the sender's OpenPGP Certificates into an Autocrypt header
+//! Generates a new key
 //!
 //! USAGE:
-//!     sq autocrypt encode-sender [OPTIONS] [FILE]
+//!     sq key generate [FLAGS] [OPTIONS] --export <OUTFILE>
 //!
 //! FLAGS:
-//!     -h, --help       Prints help information
-//!     -V, --version    Prints version information
+//!         --can-sign          The key has a signing-capable subkey (default)
+//!         --cannot-encrypt    The key will not be able to encrypt data
+//!         --cannot-sign       The key will not be able to sign data
+//!     -h, --help              Prints help information
+//!     -V, --version           Prints version information
+//!         --with-password     Prompt for a password to protect the generated key
+//!                             with.
 //!
 //! OPTIONS:
-//!         --address <address>
-//!             Select userid to use.  [default: primary userid]
+//!         --can-encrypt <PURPOSE>
+//!             The key has an encryption-capable subkey (default: universal)
+//!             [possible values: transport, storage, universal]
+//!     -c, --cipher-suite <CIPHER-SUITE>
+//!             Cryptographic algorithms used for the key. [default: cv25519]
+//!             [possible values: rsa3k, rsa4k, cv25519]
+//!         --expires <TIME>
+//!             Absolute time When the key should expire, or 'never'.
 //!
-//!     -o, --output <FILE>                      Sets the output file to use
-//!         --prefer-encrypt <prefer-encrypt>
-//!             Sets the prefer-encrypt attribute [default: nopreference]  [possible
-//!             values: nopreference, mutual]
+//!         --expires-in <DURATION>
+//!             Relative time when the key should expire.  Either 'N[ymwd]', for N
+//!             years, months, weeks, or days, or 'never'.
+//!     -e, --export <OUTFILE>
+//!             Exports the key instead of saving it in the store
 //!
-//! ARGS:
-//!     <FILE>    Sets the input file to use
+//!         --rev-cert <FILE or ->
+//!             Sets the output file for the revocation certificate. Default is
+//!             <OUTFILE>.rev, mandatory if OUTFILE is '-'.
+//!     -u, --userid <EMAIL>...
+//!             Add userid to the key (can be given multiple times)
 //! ```
 //!
 //! ## Subcommand certring
@@ -434,13 +419,33 @@
 //!     <FILE>    Sets the input file to use
 //! ```
 //!
-//! ## Subcommand dearmor
+//! ## Subcommand autocrypt
 //!
 //! ```text
-//! Removes ASCII Armor from a file
+//! Autocrypt support
 //!
 //! USAGE:
-//!     sq dearmor [OPTIONS] [FILE]
+//!     sq autocrypt <SUBCOMMAND>
+//!
+//! FLAGS:
+//!     -h, --help       Prints help information
+//!     -V, --version    Prints version information
+//!
+//! SUBCOMMANDS:
+//!     decode           Converts Autocrypt-encoded keys to OpenPGP Certificates
+//!     encode-sender    Encodes the sender's OpenPGP Certificates into an
+//!                      Autocrypt header
+//!     help             Prints this message or the help of the given
+//!                      subcommand(s)
+//! ```
+//!
+//! ### Subcommand autocrypt decode
+//!
+//! ```text
+//! Converts Autocrypt-encoded keys to OpenPGP Certificates
+//!
+//! USAGE:
+//!     sq autocrypt decode [OPTIONS] [FILE]
 //!
 //! FLAGS:
 //!     -h, --help       Prints help information
@@ -453,150 +458,225 @@
 //!     <FILE>    Sets the input file to use
 //! ```
 //!
-//! ## Subcommand enarmor
+//! ### Subcommand autocrypt encode-sender
 //!
 //! ```text
-//! Applies ASCII Armor to a file
+//! Encodes the sender's OpenPGP Certificates into an Autocrypt header
 //!
 //! USAGE:
-//!     sq enarmor [OPTIONS] [FILE]
+//!     sq autocrypt encode-sender [OPTIONS] [FILE]
 //!
 //! FLAGS:
 //!     -h, --help       Prints help information
 //!     -V, --version    Prints version information
 //!
 //! OPTIONS:
-//!         --kind <KIND>      Selects the kind of header line to produce [default:
-//!                            file]  [possible values: message, publickey,
-//!                            secretkey, signature, file]
-//!     -o, --output <FILE>    Sets the output file to use
+//!         --address <address>
+//!             Select userid to use.  [default: primary userid]
+//!
+//!     -o, --output <FILE>                      Sets the output file to use
+//!         --prefer-encrypt <prefer-encrypt>
+//!             Sets the prefer-encrypt attribute [default: nopreference]  [possible
+//!             values: nopreference, mutual]
 //!
 //! ARGS:
 //!     <FILE>    Sets the input file to use
 //! ```
 //!
-//! ## Subcommand inspect
+//! ## Subcommand keyserver
 //!
 //! ```text
-//! Inspects a sequence of OpenPGP packets
+//! Interacts with keyservers
 //!
 //! USAGE:
-//!     sq inspect [FLAGS] [FILE]
+//!     sq keyserver [OPTIONS] <SUBCOMMAND>
 //!
 //! FLAGS:
-//!         --certifications    Print third-party certifications
-//!     -h, --help              Prints help information
-//!     -V, --version           Prints version information
+//!     -h, --help       Prints help information
+//!     -V, --version    Prints version information
+//!
+//! OPTIONS:
+//!     -s, --server <URI>    Sets the keyserver to use
+//!
+//! SUBCOMMANDS:
+//!     get     Retrieves a key
+//!     help    Prints this message or the help of the given subcommand(s)
+//!     send    Sends a key
+//! ```
+//!
+//! ### Subcommand keyserver get
+//!
+//! ```text
+//! Retrieves a key
+//!
+//! USAGE:
+//!     sq keyserver get [FLAGS] [OPTIONS] <QUERY>
+//!
+//! FLAGS:
+//!     -B, --binary     Don't ASCII-armor encode the OpenPGP data
+//!     -h, --help       Prints help information
+//!     -V, --version    Prints version information
+//!
+//! OPTIONS:
+//!     -o, --output <FILE>    Sets the output file to use
+//!
+//! ARGS:
+//!     <QUERY>    Fingerprint, KeyID, or email address of the cert(s) to
+//!                retrieve
+//! ```
+//!
+//! ### Subcommand keyserver send
+//!
+//! ```text
+//! Sends a key
+//!
+//! USAGE:
+//!     sq keyserver send [FILE]
+//!
+//! FLAGS:
+//!     -h, --help       Prints help information
+//!     -V, --version    Prints version information
 //!
 //! ARGS:
 //!     <FILE>    Sets the input file to use
 //! ```
 //!
-//! ## Subcommand key
+//! ## Subcommand wkd
 //!
 //! ```text
-//! Manipulates keys
+//! Interacts with Web Key Directories
 //!
 //! USAGE:
-//!     sq key <SUBCOMMAND>
+//!     sq wkd <SUBCOMMAND>
 //!
 //! FLAGS:
 //!     -h, --help       Prints help information
 //!     -V, --version    Prints version information
 //!
 //! SUBCOMMANDS:
-//!     adopt                    Bind keys from one certificate to another.
-//!     attest-certifications
-//!             Attests third-party certifications allowing for their distribution
+//!     generate    Generates a Web Key Directory for the given domain and keys.
+//!                 If the WKD exists, the new keys will be inserted and it is
+//!                 updated and existing ones will be updated.
+//!     get         Writes to the standard output the Cert retrieved from a Web
+//!                 Key Directory, given an email address
+//!     help        Prints this message or the help of the given subcommand(s)
+//!     url         Prints the Web Key Directory URL of an email address.
+//! ```
 //!
-//!     generate                 Generates a new key
-//!     help
-//!             Prints this message or the help of the given subcommand(s)
+//! ### Subcommand wkd generate
+//!
+//! ```text
+//! Generates a Web Key Directory for the given domain and keys.  If the WKD exists,
+//! the new keys will be inserted and it is updated and existing ones will be
+//! updated.
+//!
+//! USAGE:
+//!     sq wkd generate [FLAGS] <WEB-ROOT> <DOMAIN> [KEYRING]
+//!
+//! FLAGS:
+//!     -d, --direct_method    Use the direct method. [default: advanced method]
+//!     -h, --help             Prints help information
+//!     -V, --version          Prints version information
+//!
+//! ARGS:
+//!     <WEB-ROOT>    The location to write the WKD to. This must be the
+//!                   directory the webserver is serving the '.well-known'
+//!                   directory from.
+//!     <DOMAIN>      The domain for the WKD.
+//!     <KEYRING>     The keyring file with the keys to add to the WKD.
 //! ```
 //!
-//! ### Subcommand key adopt
+//! ### Subcommand wkd get
 //!
 //! ```text
-//! Bind keys from one certificate to another.
+//! Writes to the standard output the Cert retrieved from a Web Key Directory, given
+//! an email address
 //!
 //! USAGE:
-//!     sq key adopt [FLAGS] [OPTIONS] <CERT> --key <KEY>...
+//!     sq wkd get [FLAGS] <EMAIL_ADDRESS>
 //!
 //! FLAGS:
-//!         --allow-broken-crypto
-//!             Allows adopting keys from certificates using broken cryptography.
+//!     -B, --binary     Don't ASCII-armor encode the OpenPGP data
+//!     -h, --help       Prints help information
+//!     -V, --version    Prints version information
 //!
-//!     -h, --help                   Prints help information
-//!     -V, --version                Prints version information
+//! ARGS:
+//!     <EMAIL_ADDRESS>    The email address from which to obtain the Cert from
+//!                        a WKD.
+//! ```
 //!
-//! OPTIONS:
-//!     -k, --key <KEY>...
-//!             Adds the specified key or subkey to the certificate.
+//! ### Subcommand wkd url
 //!
-//!     -r, --keyring <KEYRING>...
-//!             A keyring containing the keys specified in --key.
+//! ```text
+//! Prints the Web Key Directory URL of an email address.
+//!
+//! USAGE:
+//!     sq wkd url <EMAIL_ADDRESS>
 //!
+//! FLAGS:
+//!     -h, --help       Prints help information
+//!     -V, --version    Prints version information
 //!
 //! ARGS:
-//!     <CERT>    The certificate to add keys to.
+//!     <EMAIL_ADDRESS>    The email address from which to obtain the WKD URI.
 //! ```
 //!
-//! ### Subcommand key attest-certifications
+//! ## Subcommand enarmor
 //!
 //! ```text
-//! Attests third-party certifications allowing for their distribution
+//! Applies ASCII Armor to a file
 //!
 //! USAGE:
-//!     sq key attest-certifications [FLAGS] <KEY>
+//!     sq enarmor [OPTIONS] [FILE]
 //!
 //! FLAGS:
-//!         --all        Attest to all certifications
 //!     -h, --help       Prints help information
-//!         --none       Remove all prior attestations
 //!     -V, --version    Prints version information
 //!
+//! OPTIONS:
+//!         --kind <KIND>      Selects the kind of header line to produce [default:
+//!                            file]  [possible values: message, publickey,
+//!                            secretkey, signature, file]
+//!     -o, --output <FILE>    Sets the output file to use
+//!
 //! ARGS:
-//!     <KEY>    Change attestations on this key.
+//!     <FILE>    Sets the input file to use
 //! ```
 //!
-//! ### Subcommand key generate
+//! ## Subcommand dearmor
 //!
 //! ```text
-//! Generates a new key
+//! Removes ASCII Armor from a file
 //!
 //! USAGE:
-//!     sq key generate [FLAGS] [OPTIONS] --export <OUTFILE>
+//!     sq dearmor [OPTIONS] [FILE]
 //!
 //! FLAGS:
-//!         --can-sign          The key has a signing-capable subkey (default)
-//!         --cannot-encrypt    The key will not be able to encrypt data
-//!         --cannot-sign       The key will not be able to sign data
-//!     -h, --help              Prints help information
-//!     -V, --version           Prints version information
-//!         --with-password     Prompt for a password to protect the generated key
-//!                             with.
+//!     -h, --help       Prints help information
+//!     -V, --version    Prints version information
 //!
 //! OPTIONS:
-//!         --can-encrypt <PURPOSE>
-//!             The key has an encryption-capable subkey (default: universal)
-//!             [possible values: transport, storage, universal]
-//!     -c, --cipher-suite <CIPHER-SUITE>
-//!             Cryptographic algorithms used for the key. [default: cv25519]
-//!             [possible values: rsa3k, rsa4k, cv25519]
-//!         --expires <TIME>
-//!             Absolute time When the key should expire, or 'never'.
+//!     -o, --output <FILE>    Sets the output file to use
 //!
-//!         --expires-in <DURATION>
-//!             Relative time when the key should expire.  Either 'N[ymwd]', for N
-//!             years, months, weeks, or days, or 'never'.
-//!     -e, --export <OUTFILE>
-//!             Exports the key instead of saving it in the store
+//! ARGS:
+//!     <FILE>    Sets the input file to use
+//! ```
 //!
-//!         --rev-cert <FILE or ->
-//!             Sets the output file for the revocation certificate. Default is
-//!             <OUTFILE>.rev, mandatory if OUTFILE is '-'.
-//!     -u, --userid <EMAIL>...
-//!             Add userid to the key (can be given multiple times)
+//! ## Subcommand inspect
+//!
+//! ```text
+//! Inspects a sequence of OpenPGP packets
+//!
+//! USAGE:
+//!     sq inspect [FLAGS] [FILE]
+//!
+//! FLAGS:
+//!         --certifications    Print third-party certifications
+//!     -h, --help              Prints help information
+//!     -V, --version           Prints version information
+//!
+//! ARGS:
+//!     <FILE>    Sets the input file to use
 //! ```
 //!
 //! ## Subcommand packet
@@ -711,86 +791,6 @@
 //! ARGS:
 //!     <FILE>    Sets the input file to use
 //! ```
-//!
-//! ## Subcommand wkd
-//!
-//! ```text
-//! Interacts with Web Key Directories
-//!
-//! USAGE:
-//!     sq wkd <SUBCOMMAND>
-//!
-//! FLAGS:
-//!     -h, --help       Prints help information
-//!     -V, --version    Prints version information
-//!
-//! SUBCOMMANDS:
-//!     generate    Generates a Web Key Directory for the given domain and keys.
-//!                 If the WKD exists, the new keys will be inserted and it is
-//!                 updated and existing ones will be updated.
-//!     get         Writes to the standard output the Cert retrieved from a Web
-//!                 Key Directory, given an email address
-//!     help        Prints this message or the help of the given subcommand(s)
-//!     url         Prints the Web Key Directory URL of an email address.
-//! ```
-//!
-//! ### Subcommand wkd generate
-//!
-//! ```text
-//! Generates a Web Key Directory for the given domain and keys.  If the WKD exists,
-//! the new keys will be inserted and it is updated and existing ones will be
-//! updated.
-//!
-//! USAGE:
-//!     sq wkd generate [FLAGS] <WEB-ROOT> <DOMAIN> [KEYRING]
-//!
-//! FLAGS:
-//!     -d, --direct_method    Use the direct method. [default: advanced method]
-//!     -h, --help             Prints help information
-//!     -V, --version          Prints version information
-//!
-//! ARGS:
-//!     <WEB-ROOT>    The location to write the WKD to. This must be the
-//!                   directory the webserver is serving the '.well-known'
-//!                   directory from.
-//!     <DOMAIN>      The domain for the WKD.
-//!     <KEYRING>     The keyring file with the keys to add to the WKD.
-//! ```
-//!
-//! ### Subcommand wkd get
-//!
-//! ```text
-//! Writes to the standard output the Cert retrieved from a Web Key Directory, given
-//! an email address
-//!
-//! USAGE:
-//!     sq wkd get [FLAGS] <EMAIL_ADDRESS>
-//!
-//! FLAGS:
-//!     -B, --binary     Don't ASCII-armor encode the OpenPGP data
-//!     -h, --help       Prints help information
-//!     -V, --version    Prints version information
-//!
-//! ARGS:
-//!     <EMAIL_ADDRESS>    The email address from which to obtain the Cert from
-//!                        a WKD.
-//! ```
-//!
-//! ### Subcommand wkd url
-//!
-//! ```text
-//! Prints the Web Key Directory URL of an email address.
-//!
-//! USAGE:
-//!     sq wkd url <EMAIL_ADDRESS>
-//!
-//! FLAGS:
-//!     -h, --help       Prints help information
-//!     -V, --version    Prints version information
-//!
-//! ARGS:
-//!     <EMAIL_ADDRESS>    The email address from which to obtain the WKD URI.
-//! ```
 
 #![doc(html_favicon_url = "https://docs.sequoia-pgp.org/favicon.png")]
 #![doc(html_logo_url = "https://docs.sequoia-pgp.org/logo.svg")]
diff --git a/sq/src/sq_cli.rs b/sq/src/sq_cli.rs
index a5ec85ec..1e518d08 100644
--- a/sq/src/sq_cli.rs
+++ b/sq/src/sq_cli.rs
@@ -6,6 +6,16 @@ pub fn build() -> App<'static, 'static> {
     configure(App::new("sq"))
 }
 
+/// Defines the CLI.
+///
+/// The order of top-level subcommands is:
+///
+///   - Encryption & decryption             (1xx)
+///   - Signing & verification              (2xx)
+///   - Key & cert-ring management          (3xx)
+///   - Key discovery & networking          (4xx)
+///   - Armor                               (5xx)
+///   - Inspection & packet manipulation    (6xx)
 pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
     let app = app
         .version(env!("CARGO_PKG_VERSION"))
@@ -23,7 +33,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
                critical bit set are considered invalid."))
 
         .subcommand(SubCommand::with_name("decrypt")
-                    .display_order(10)
+                    .display_order(110)
                     .about("Decrypts an OpenPGP message")
                     .arg(Arg::with_name("input")
                          .value_name("FILE")
@@ -58,7 +68,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
         )
 
         .subcommand(SubCommand::with_name("encrypt")
-                    .display_order(20)
+                    .display_order(100)
                     .about("Encrypts a message")
                     .arg(Arg::with_name("input")
                          .value_name("FILE")
@@ -112,7 +122,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
         )
 
         .subcommand(SubCommand::with_name("merge-signatures")
-                    .display_order(31)
+                    .display_order(250)
                     .about("Merges two signatures")
                     .arg(Arg::with_name("input1")
                          .value_name("FILE")
@@ -126,7 +136,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
         )
 
         .subcommand(SubCommand::with_name("sign")
-                    .display_order(25)
+                    .display_order(200)
                     .about("Signs a message")
                     .arg(Arg::with_name("input")
                          .value_name("FILE")
@@ -160,7 +170,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
         )
 
         .subcommand(SubCommand::with_name("verify")
-                    .display_order(26)
+                    .display_order(210)
                     .about("Verifies a message")
                     .arg(Arg::with_name("input")
                          .value_name("FILE")
@@ -184,6 +194,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
         )
 
         .subcommand(SubCommand::with_name("enarmor")
+                    .display_order(500)
                     .about("Applies ASCII Armor to a file")
                     .arg(Arg::with_name("input")
                          .value_name("FILE")
@@ -200,6 +211,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {
         )
 
         .subcommand(SubCommand::with_name("dearmor")
+                    .display_order(510)
                     .about("Removes ASCII Armor from a file")
                     .arg(Arg::with_name("input")
                          .value_name("FILE")
@@ -210,6 +222,7 @@ pub fn configure(app: App<'static, 'static>) -> App<'static, 'static> {