docs(plugins): document keystore list address trust model

Clarify that 'keystore list' displays the declared address from each
keystore's JSON without decrypting it. A tampered keystore may claim an
address that does not correspond to its encrypted key; verification only
happens at decryption time (e.g. 'keystore update').

Author: Barbatos

plugins/README.md

@@ -193,6 +193,8 @@ List all keystore files in a directory.
   java -jar Toolkit.jar keystore list --keystore-dir /data/keystores   # custom directory
 ```
 
+> **Note**: `list` displays the `address` field as declared in each keystore JSON without decrypting the file. A tampered keystore can claim an address that does not correspond to its encrypted private key. The address is only cryptographically verified at decryption time (e.g. by `update` or by tools that load the credentials). Only trust keystores from sources you control.
+
 #### keystore update
 
 Change the password of a keystore file.