docs: Document how to get the WG public key from systemd-creds

Also rearranged the documentation a bit.

Fixes: 27553ab3 ("Remove the WG private keys from the vault and store them only on the servers")