Add note about not accessing cert locally in prod

Author: Rand McKinney

README.md

@@ -72,6 +72,8 @@ except Exception as err:
 
 ### Add a signed manifest to a media file or stream
 
+**WARNING**: This example accesses the private key and security certficate directly from the local file system.  This is fine during development, but don't do it production because it exposes these sensitive files to potential attackers. Instead use a hardware security module (HSM) and optionally a Key Management Service (KMS) to access them; for example as show in the [C2PA Python Example](https://github.com/contentauth/c2pa-python-example).
+
 Use a `Builder` to add a manifest to an asset.
 
 ```py