Document the watermark's fold-unknown-keys contract (#836)