docs(host): the P-256 identity comment still named ring's backend

#192 moved rcgen to aws-lc-rs and removed ring from the tree, but this comment
still explained the P-256 path in terms of "rcgen's ring backend". It also
cross-references gamestream::cert's note, which this branch already corrected —
so leaving it made the two contradict each other.

The substance is unchanged and still load-bearing: rcgen generates EC keys
directly, while RSA has to be generated by the `rsa` crate and handed to rcgen
to self-sign, because no rcgen backend will generate an RSA key.

crates/punktfunk-host/src/identity.rs

@@ -113,8 +113,9 @@ pub fn ephemeral() -> Result<NativeIdentity> {
     Ok(NativeIdentity { cert_pem, key_pem })
 }
 
-/// Generate the P-256 identity: ring CAN generate EC keys (unlike RSA — see `gamestream::cert`'s
-/// note), so rcgen's ring backend does the whole thing. SANs cover the names a browser or a
+/// Generate the P-256 identity: rcgen CAN generate EC keys, so it does the whole thing here —
+/// unlike RSA, which no rcgen backend will generate (see `gamestream::cert`'s note, where the key
+/// comes from the `rsa` crate and rcgen only self-signs it). SANs cover the names a browser or a
 /// loopback poller actually dials; LAN IPs are deliberately absent (they change, and the native
 /// clients pin the fingerprint rather than verify names).
 fn generate() -> Result<(String, String)> {